doc: update 1.9 release with RTD theme

We've replaced the "zephyr-docs" theme with a simpler read-the-docs
theme starting with the 1.13 release. This PR retrofits the theme
changes back onto this 1.9 release and ignores attempts to use the
zephyr-docs theme controlled by the make DOC_TAGS option.

Also needed to backport changes to the warning filtering system
implemented in later releases, fixes to how the config options were
generated (genrest.py).

Signed-off-by: David B. Kinder <david.b.kinder@intel.com>

.known-issues/doc/duplicate.conf

@@ -0,0 +1,6 @@
+#
+^(?P<filename>([-:\\/\w\.])+[/\\]doc[/\\]api[/\\]file_system.rst):(?P<lineno>[0-9]+): WARNING: Duplicate declaration.
+#
+^(?P<filename>([-:\\/\w\.])+[/\\]doc[/\\]api[/\\]io_interfaces.rst):(?P<lineno>[0-9]+): WARNING: Duplicate declaration.
+#
+^(?P<filename>([-:\\/\w\.])+[/\\]doc[/\\]subsystems[/\\]sensor.rst):(?P<lineno>[0-9]+): WARNING: Duplicate declaration.

.known-issues/doc/networking.conf

@@ -20,12 +20,12 @@
 # include/net/net_if.h warnings
 #
 ^(?P<filename>[-._/\w]+/doc/api/networking.rst):(?P<lineno>[0-9]+): WARNING: Error when parsing function declaration.
-^\If the function has no return type:
+^If the function has no return type:
 ^[ \t]*Error in declarator or parameters and qualifiers
 ^[ \t]*Invalid definition: Expected identifier in nested name, got keyword: struct \[error at [0-9]+]
 ^.*struct net_if __aligned\(32\)
 ^[- \t]*\^
-^\If the function has a return type:
+^If the function has a return type:
 ^[ \t]*Error in declarator or parameters and qualifiers
 ^[ \t]*If pointer to member declarator:
 ^[ \t]*Invalid definition: Expected \'::\' in pointer to member \(function\). \[error at [0-9]+]

.shippable.yml

@@ -4,10 +4,10 @@ compiler: gcc
 
 env:
     global:
-        - SDK=0.9.1
+        - SDK=0.9.2
         - SANITYCHECK_OPTIONS=" --inline-logs -R"
         - SANITYCHECK_OPTIONS_RETRY="${SANITYCHECK_OPTIONS} --only-failed --outdir=out-2nd-pass"
-        - ZEPHYR_SDK_INSTALL_DIR=/opt/sdk/zephyr-sdk-0.9.1
+        - ZEPHYR_SDK_INSTALL_DIR=/opt/sdk/zephyr-sdk-0.9.2
         - ZEPHYR_GCC_VARIANT=zephyr
         - USE_CCACHE=1
         - MATRIX_BUILDS="2"
@@ -23,29 +23,20 @@ build:
         - ${SHIPPABLE_BUILD_DIR}/ccache
     pre_ci_boot:
         image_name: zephyrprojectrtos/ci
-        image_tag: master.27
+        image_tag: v0.2
         pull: true
         options: "-e HOME=/home/buildslave --privileged=true --tty --net=bridge --user buildslave"
 
     ci:
       - export CCACHE_DIR=${SHIPPABLE_BUILD_DIR}/ccache/.ccache
-      - git rebase origin/${PULL_REQUEST_BASE_BRANCH}
+      - >
+        if [ "$IS_PULL_REQUEST" = "true" ]; then
+          git rebase origin/${PULL_REQUEST_BASE_BRANCH};
+        fi
       - source zephyr-env.sh
       - ccache -c -s --max-size=2000M
       - make host-tools
       - export PREBUILT_HOST_TOOLS=${ZEPHYR_BASE}/bin
-      - >
-          if [ "$IS_PULL_REQUEST" = "true" ]; then
-            S3_PATH="s3://zephyr-logs/pull-requests/${REPO_FULL_NAME}/${PULL_REQUEST}"
-          else
-            if [ "$JOB_TRIGGERED_BY_NAME" = "undefined" ]; then
-              LOG_TYPE="manual";
-            else
-              LOG_TYPE=${JOB_TRIGGERED_BY_NAME};
-            fi;
-
-            S3_PATH="s3://zephyr-logs/${LOG_TYPE}/${REPO_FULL_NAME}/${BUILD_NUMBER}";
-          fi;
       - >
           if [ "$MATRIX_BUILD" = "3" -a "$IS_PULL_REQUEST" = "true" ]; then
             export COMMIT_RANGE=origin/${PULL_REQUEST_BASE_BRANCH}..HEAD
@@ -66,19 +57,20 @@ build:
             ./scripts/ci/check-compliance.py --commits ${COMMIT_RANGE} || true;
           fi;
       - >
-          sudo pip3 install sh;
-          ./scripts/ci/get_modified_tests.py --commits origin/${PULL_REQUEST_BASE_BRANCH}..HEAD > modified_tests.args;
-          ./scripts/ci/get_modified_boards.py --commits origin/${PULL_REQUEST_BASE_BRANCH}..HEAD > modified_boards.args;
+          if [ "$IS_PULL_REQUEST" = "true" ]; then
+            ./scripts/ci/get_modified_tests.py --commits origin/${PULL_REQUEST_BASE_BRANCH}..HEAD > modified_tests.args;
+            ./scripts/ci/get_modified_boards.py --commits origin/${PULL_REQUEST_BASE_BRANCH}..HEAD > modified_boards.args;
 
-          if [ -s modified_boards.args ]; then
-            ./scripts/sanitycheck --subset ${MATRIX_BUILD}/${MATRIX_BUILDS_EXTRA} +modified_boards.args || ./scripts/sanitycheck +modified_boards.args --only-failed;
-            cp ./scripts/sanity_chk/last_sanity.xml modified_boards.xml;
-          fi;
-          if [ -s modified_tests.args ]; then
-            ./scripts/sanitycheck --subset ${MATRIX_BUILD}/${MATRIX_BUILDS_EXTRA} +modified_tests.args || ./scripts/sanitycheck +modified_tests.args --only-failed
-            cp ./scripts/sanity_chk/last_sanity.xml modified_tests.xml;
-          fi;
-          rm -f modified_tests.args modified_boards.args;
+            if [ -s modified_boards.args ]; then
+              ./scripts/sanitycheck --subset ${MATRIX_BUILD}/${MATRIX_BUILDS_EXTRA} +modified_boards.args || ./scripts/sanitycheck +modified_boards.args --only-failed;
+              cp ./scripts/sanity_chk/last_sanity.xml modified_boards.xml;
+            fi;
+            if [ -s modified_tests.args ]; then
+              ./scripts/sanitycheck --subset ${MATRIX_BUILD}/${MATRIX_BUILDS_EXTRA} +modified_tests.args || ./scripts/sanitycheck +modified_tests.args --only-failed;
+              cp ./scripts/sanity_chk/last_sanity.xml modified_tests.xml;
+            fi;
+            rm -f modified_tests.args modified_boards.args;
+          fi
       - >
           if [ "$MATRIX_BUILD" != "3" ]; then
              ./scripts/sanitycheck ${PLATFORMS} --subset ${MATRIX_BUILD}/${MATRIX_BUILDS} ${COVERAGE} ${SANITYCHECK_OPTIONS} || ./scripts/sanitycheck ${PLATFORMS} ${COVERAGE} ${SANITYCHECK_OPTIONS_RETRY} || ./scripts/sanitycheck ${PLATFORMS} ${COVERAGE} ${SANITYCHECK_OPTIONS_RETRY}
@@ -90,40 +82,29 @@ build:
       - >
           if [ -e compliance.xml ]; then
             cp compliance.xml shippable/testresults/;
-            aws s3 cp compliance.xml ${S3_PATH}/;
           fi;
       - >
           if [ -e ./scripts/sanity_chk/last_sanity.xml ]; then
             cp ./scripts/sanity_chk/last_sanity.xml shippable/testresults/;
-            aws s3 cp ./scripts/sanity_chk/last_sanity.xml ${S3_PATH}/sanitycheck.${MATRIX_BUILD}.xml;
           fi;
       - >
           if [ -e ./modified_tests.xml ]; then
             cp ./modified_tests.xml shippable/testresults/;
-            aws s3 cp ./modified_tests.xml ${S3_PATH}/modified_tests.xml;
           fi;
     on_success:
       - rm -rf sanity-out out-2nd-pass
       - mkdir -p shippable/testresults
-      - >
-          if [ "$MATRIX_BUILD" = "3" -a "$IS_PULL_REQUEST" = "true" ]; then
-            aws s3 sync --quiet  doc/_build/html ${S3_PATH}/doc;
-            aws s3 sync --quiet  doc/doxygen/html ${S3_PATH}/api;
-          fi
       - >
           if [ -e compliance.xml ]; then
             cp compliance.xml shippable/testresults/;
-            aws s3 cp compliance.xml ${S3_PATH}/;
           fi;
       - >
           if [ -e ./scripts/sanity_chk/last_sanity.xml ]; then
             cp ./scripts/sanity_chk/last_sanity.xml shippable/testresults/;
-            aws s3 cp ./scripts/sanity_chk/last_sanity.xml ${S3_PATH}/sanitycheck.${MATRIX_BUILD}..xml;
           fi;
       - >
           if [ -e ./modified_tests.xml ]; then
             cp ./modified_tests.xml shippable/testresults/;
-            aws s3 cp ./modified_tests.xml ${S3_PATH}/modified_tests.xml;
           fi;
 
 integrations:

Makefile

@@ -1,8 +1,8 @@
 VERSION_MAJOR 	   = 1
 VERSION_MINOR 	   = 9
-PATCHLEVEL 	   = 0
+PATCHLEVEL 	   = 2
 VERSION_RESERVED   = 0
-EXTRAVERSION       = -rc3
+EXTRAVERSION       =
 NAME 		   = Zephyr Kernel
 
 export SOURCE_DIR PROJECT

boards/xtensa/esp32/doc/esp32.rst

@@ -15,7 +15,7 @@ From Wikipedia:
    Tensilica Xtensa LX6 microprocessor in both dual-core and single-core
    variations.  ESP32 is created and developed by Espressif Systems, a
    Shanghai-based Chinese company, and is manufactured by TSMC using their 40nm
-   process. [1]_
+   process..
 
 The features include the following:
 
@@ -171,7 +171,6 @@ for ESP32`_.
 References
 **********
 
-.. [1] https://en.wikipedia.org/wiki/ESP32
 .. _`ESP32 Technical Reference Manual`: https://espressif.com/sites/default/files/documentation/esp32_technical_reference_manual_en.pdf
 .. _`JTAG debugging for ESP32`: https://espressif.com/sites/default/files/documentation/jtag_debugging_for_esp32_en.pdf
 .. _`toolchain`: https://esp-idf.readthedocs.io/en/latest/get-started/index.html#get-started-setup-toochain

doc/Makefile

@@ -66,6 +66,8 @@ clean:
 	@rm -rf reference/kconfig/*.rst
 	@rm -rf samples
 	@rm -rf boards
+	@rm -f doc.log
+	@rm -f doc.warnings
 
 htmldocs: doxy html
 
@@ -79,7 +81,8 @@ kconfig: scripts/genrest/genrest.py
 prep: doxy content kconfig
 
 html: content kconfig
-	$(Q)$(SPHINXBUILD) -t $(DOC_TAG) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html
+	$(Q)$(SPHINXBUILD) -t $(DOC_TAG) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html 2>&1 | tee -a doc.log;
+	$(Q)./scripts/filter-doc-log.sh doc.log
 	@rm -rf samples
 	@rm -rf boards
 

doc/_templates/breadcrumbs.html

@@ -0,0 +1,14 @@
+{% extends "!breadcrumbs.html" %}
+{% block breadcrumbs %}
+  <!-- {{ docs_title }} -->
+  {# parameterize default name "Docs" in breadcrumb via docs_title in conf.py #}
+  {% if not docs_title %}
+  {% set docs_title = "Docs" %}
+  {% endif %}
+
+  <li><a href="{{ pathto(master_doc) }}">{{ docs_title }}</a> &raquo;</li>
+  {% for doc in parents %}
+     <li><a href="{{ doc.link|e }}">{{ doc.title }}</a> &raquo;</li>
+  {% endfor %}
+  <li>{{ title }}</li>
+{% endblock %}

doc/_templates/layout.html

@@ -0,0 +1,10 @@
+{% extends "!layout.html" %}
+{% block document %}
+  {% if is_release %}
+    <div class="wy-alert wy-alert-danger">
+      The <a href="/{{ pagename }}.html">latest development version</a>
+      of this page may be more current than this released {{ version }} version.
+    </div>
+  {% endif %}
+  {{ super() }}
+{% endblock %}

doc/_templates/versions.html

@@ -0,0 +1,28 @@
+{# Add rst-badge after rst-versions for small badge style. #}
+  <div class="rst-versions" data-toggle="rst-versions" role="note" aria-label="versions">
+    <span class="rst-current-version" data-toggle="rst-current-version">
+      <span class="fa fa-book"> Zephyr Project</span>
+      v: {{ current_version }}
+      <span class="fa fa-caret-down"></span>
+    </span>
+    <div class="rst-other-versions">
+      <dl>
+        <dt>{{ _('Versions') }}</dt>
+        {% for slug, url in versions %}
+          <dd><a href="{{ url }}">{{ slug }}</a></dd>
+        {% endfor %}
+      </dl>
+      <dl>
+        <dt>{{ _('On zephyrproject.org') }}</dt>
+          <dd>
+            <a href="https://www.zephyrproject.org/">Project Home</a>
+          </dd>
+          <dd>
+            <a href="https://www.zephyrproject.org/developers/#downloads">Downloads</a>
+          </dd>
+          <dd>
+            <a href="https://github.com/zephyrproject-rtos/zephyr/releases">Releases</a>
+          </dd>
+      </dl>
+    </div>
+  </div>

doc/conf.py

@@ -143,23 +143,15 @@ rst_epilog = """
 
 # -- Options for HTML output ----------------------------------------------
 
-try:
-    import sphinx_rtd_theme
-except ImportError:
-    html_theme = 'zephyr'
-    html_theme_path = ['./themes']
-else:
-    html_theme = "sphinx_rtd_theme"
-    html_theme_path = [sphinx_rtd_theme.get_html_theme_path()]
-
-if tags.has('daily') or tags.has('release'):
-    html_theme = 'zephyr-docs-theme'
-    html_theme_path = ['./themes']
-
+import sphinx_rtd_theme
+html_theme = "sphinx_rtd_theme"
+html_theme_path = [sphinx_rtd_theme.get_html_theme_path()]
 
 if tags.has('release'):
+    is_release = True
     docs_title = 'Docs / %s' %(version)
 else:
+    is_release = False
     docs_title = 'Docs'
 
 # The name for this set of Sphinx documents.  If None, it defaults to
@@ -175,12 +167,12 @@ html_title = "Zephyr Project Documentation"
 
 # The name of an image file (relative to this directory) to place at the top
 # of the sidebar.
-#html_logo = None
+html_logo = 'images/Zephyr-Kite-logo.png'
 
 # The name of an image file (within the static path) to use as favicon of the
 # docs.  This file should be a Windows icon file (.ico) being 16x16 or 32x32
 # pixels large.
-#html_favicon = None
+html_favicon = 'images/zp_favicon.png'
 
 # Add any paths that contain custom static files (such as style sheets) here,
 # relative to this directory. They are copied after the builtin static files,
@@ -217,7 +209,7 @@ html_use_index = True
 html_split_index = True
 
 # If true, links to the reST sources are added to the pages.
-#html_show_sourcelink =
+html_show_sourcelink = False
 
 # If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
 html_show_sphinx = False
@@ -342,10 +334,28 @@ breathe_projects = {
 }
 breathe_default_project = "Zephyr"
 
+# Qualifiers to a function are causing Sphihx/Breathe to warn about
+# Error when parsing function declaration and more.  This is a list
+# of strings that the parser additionally should accept as
+# attributes.
+cpp_id_attributes = ['__syscall', '__syscall_inline', '__deprecated',
+    '__may_alias', '__used', '__unused', '__weak',
+    '__DEPRECATED_MACRO', 'FUNC_NORETURN' ]
+
+
 # docs_title is used in the breadcrumb title in the zephyr docs theme
 html_context = {
     'show_license': html_show_license,
     'docs_title': docs_title,
+    'is_release': is_release,
+    'theme_logo_only': False,
+    'current_version': version,
+    'versions': ( ("latest", "/"),
+                 ("1.12.0", "/1.12.0/"),
+                 ("1.11.0", "/1.11.0/"),
+                 ("1.10.0", "/1.10.0/"),
+                 ("1.9.2", "/1.9.0/"),
+                )
 }
 
 extlinks = {'jira': ('https://jira.zephyrproject.org/browse/%s', '')}
@@ -364,3 +374,4 @@ linkcheck_anchors = False
 
 def setup(app):
    app.add_stylesheet("zephyr-custom.css")
+   app.add_javascript("zephyr-custom.js")

doc/release-notes-1.9.rst

@@ -2,22 +2,59 @@
 
 .. _zephyr_1.9:
 
-Zephyr Kernel 1.9.0 (WIP)
-#########################
+Zephyr Kernel 1.9.2
+###################
+
+This is a maintenance release with fixes.
+
+Kernel
+******
+* Generic queue item acquisition fixed to always return a valid item when
+  using K_FOREVER
+
+Bluetooth
+*********
+* Multiple stability fixes for BLE Mesh
+* Multiple stability fixes for the BLE Controller
+
+Zephyr Kernel 1.9.1
+###################
+
+This is a maintenance release with fixes and a two new features in the
+BLE Controller.
+
+Drivers and Sensors
+*******************
+* mcux ethernet driver buffer overflow fixed
+* STM32 PWM prescaler issue fixed
+
+Networking
+**********
+* Support for IPv6 in DNS fixed
+
+Bluetooth
+*********
+* Multiple stability fixes for the BLE Controller
+* Support for PA/LNA amplifiers in the BLE Controller
+* Support for additional VS commands in the BLE Controller
+
+Zephyr Kernel 1.9.0
+###################
 
 We are pleased to announce the release of Zephyr kernel version 1.9.0
-(planned for release in August 2017).
 
 Major enhancements planned with this release include:
 
+* Bluetooth 5.0 Support (all features except Advertising Extensions)
+* Bluetooth Qualification-ready BLE Controller
+* BLE Mesh
+* Lightweight Machine to Machine (LwM2M) support
 * Pthreads compatible API
 * BSD Sockets compatible API
-* Expand Device Tree support to more architectures
-* BLE Mesh
-* Bluetooth 5.0 Support (all features except Advertising Extensions)
-* Revamp Testsuite, Increase Coverage
-* Lightweight Machine to Machine (LwM2M) support
 * MMU/MPU (Cont.): Thread Isolation, Paging
+* Expand Device Tree support to more architectures
+* Revamp Testsuite, Increase Coverage
+* Stack Sentinel support (See details below)
 
 The following sections provide detailed lists of changes by component.
 
@@ -26,6 +63,7 @@ Kernel
 
 * Added POSIX thread IPC support for Kernel
 * kernel: introduce opaque data type for stacks
+* Timeslicing and tickless kernel improvements
 
 Architectures
 *************
@@ -34,7 +72,14 @@ Architectures
 * arm: Added TI CC2650 SoC
 * arm: Removed TI CC3200 SoC
 * arm: Added MPU support to nRF52, STM32L4, and STM32F3
-* xtensa: Added ESP32
+* xtensa: Added ESP32 support
+* Stack sentinel: This places a sentinel value at the lowest 4 bytes of a stack
+  memory region and checks it at various intervals, including when servicing
+  interrupts or context switching.
+* x86: Enable MMU for application memory
+* ARC: Added initial MPU support, including stack sentinel checking for ARC
+  configurations not featuring hardware stack bounds checking
+* ARC: Nested interrupt support for normal, non-FIRQ interrupts
 
 Boards
 ******
@@ -47,7 +92,10 @@ Boards
 * arm: Added TI SensorTag board
 * arm: Removed TI CC3200 LaunchXL board
 * arm: Added VBLUno51 and VBLUno52 boards
-* xtensa: Added ESP32
+* xtensa: Added ESP32 board support
+* ARC: Added support for EMSK EM7D v2.2 version (incl. MPU)
+* ARC: Board configuration restructuring, peripheral configs moved from soc to
+  board level
 
 Drivers and Sensors
 *******************
@@ -59,6 +107,7 @@ Drivers and Sensors
 * Removed deprecated PWM driver APIs
 * Added ESP32 drivers for GPIO, pin mux, watchdog, random number generator,
   and UART
+* sensor: Add BMM150 Geomagnetic sensor driver
 
 Networking
 **********
@@ -101,6 +150,7 @@ Bluetooth
   prefix as the Bluetooth APIs, namely BT_* instead of BLUETOOTH_*.
   Controller Kconfig options have been shortened to use CTLR instead of
   CONTROLLER.
+* Removed deprecated NBLE support
 
 Build and Infrastructure
 ************************
@@ -129,6 +179,7 @@ Documentation
 * CONTRIBUTING.rst and Contribution Guide material added
 * Configuration options doc reorganized for easier access
 * Navigation sidebar issues fixed for supported boards section
+* Fixed link targets hidden behind header
 * Completed migration of wiki.zephyrproject.org content into docs and
   GitHub wiki. All links to old wiki updated.
 * Broken link and spelling check scans through .rst, Kconfig (used for
@@ -141,6 +192,12 @@ Documentation
   pip requirements.txt
 
 
+Build System and Tools
+**********************
+* Convert post-processing host tools to python, this includes the following
+  tools: gen_offset_header.py gen_idt.py gen_gdt.py gen_mmu.py
+
+
 Tests and Samples
 *****************
 
@@ -153,11 +210,14 @@ JIRA Related Items
 * :jira:`ZEP-230` - Define I2S driver APIs
 * :jira:`ZEP-601` - enable CONFIG_DEBUG_INFO
 * :jira:`ZEP-702` - Integrate Nordic's Phoenix Link Layer into Zephyr
+* :jira:`ZEP-749` - TinyCrypt uses an old, unoptimized version of micro-ecc
 * :jira:`ZEP-896` - nRF5x Series: Add support for power and clock peripheral
+* :jira:`ZEP-1067` - Driver for BMM150
 * :jira:`ZEP-1396` - Add ksdk adc shim driver
 * :jira:`ZEP-1426` - CONFIG_BOOT_TIME_MEASUREMENT on all targets?
 * :jira:`ZEP-1552` - Provide apds9960 sensor driver
 * :jira:`ZEP-1647` - Figure out new combo for breathe/doxygen/sphinx versions that are supported
+* :jira:`ZEP-1744` - UPF 56 BLE Controller Issues
 * :jira:`ZEP-1751` - Add template YAML file
 * :jira:`ZEP-1819` - Add tickless kernel support in nrf_rtc_timer timer
 * :jira:`ZEP-1843` - provide mechanism to filter test cases based on available hardware
@@ -165,11 +225,13 @@ JIRA Related Items
 * :jira:`ZEP-1902` - Missing board documentation for arm/nucleo_f334r8
 * :jira:`ZEP-1911` - Missing board documentation for arm/stm3210c_eval
 * :jira:`ZEP-1917` - Missing board documentation for arm/stm32373c_eval
+* :jira:`ZEP-1918` - Fix connection parameter request procedure
 * :jira:`ZEP-2018` - Remove deprecated PWM APIs
 * :jira:`ZEP-2020` - tests/crypto/test_ecc_dsa intermittently fails on riscv32
 * :jira:`ZEP-2025` - Add mcux pwm shim driver for k64
 * :jira:`ZEP-2031` - ESP32 Architecture Configuration
 * :jira:`ZEP-2032` - Espressif Open-source Toolchain Support
+* :jira:`ZEP-2039` - Implement stm32cube LL based clock control driver
 * :jira:`ZEP-2054` - Convert all helper script to use python3
 * :jira:`ZEP-2062` - Convert gen_offset_header to a python script
 * :jira:`ZEP-2063` - Convert gen_idt to python
@@ -179,18 +241,24 @@ JIRA Related Items
 * :jira:`ZEP-2089` - UART support for ESP32
 * :jira:`ZEP-2115` - Common API for networked applications for setting up network
 * :jira:`ZEP-2116` - Common API for networked apps to create client/server applications
+* :jira:`ZEP-2141` - Coverity CID 169303 in tests/net/ipv6/src/main.c
 * :jira:`ZEP-2150` - Move Arduino 101 to Device Tree
 * :jira:`ZEP-2151` - Move Quark D2000 to device tree
 * :jira:`ZEP-2156` - Build warnings [-Wformat] with LLVM/icx (tests/kernel/sprintf)
 * :jira:`ZEP-2168` - Timers seem to be broken with TICKLESS_KERNEL on nRF51 (Cortex M0)
+* :jira:`ZEP-2171` - Move all board pinmux code from drivers/pinmux/stm32 to the corrosponding board/soc locations
 * :jira:`ZEP-2184` - Split data, bss, noinit sections into application and kernel areas
 * :jira:`ZEP-2188` - x86: Implement simple stack memory protection
 * :jira:`ZEP-2217` - schedule_api test fails on ARM with tickless kernel enabled
 * :jira:`ZEP-2218` - unexpected short timeslice when running schedule_api with tickless kernel enabled
+* :jira:`ZEP-2220` - Extend MPU to stm32 family
 * :jira:`ZEP-2225` - Ability to unregister GATT services
+* :jira:`ZEP-2226` - BSD Sockets API: Basic blocking API
+* :jira:`ZEP-2227` - BSD Sockets API: Non-blocking API
 * :jira:`ZEP-2229` - test_time_slicing_preemptible fails on bbc_microbit and other NRF boards
 * :jira:`ZEP-2250` - sanitycheck not filtering defconfigs properly
 * :jira:`ZEP-2258` - Coverity static scan issues seen
+* :jira:`ZEP-2265` - stack declaration macros for ARM MPU
 * :jira:`ZEP-2267` - Create Release Notes
 * :jira:`ZEP-2270` - Convert mpu_stack_guard_test from using k_thread_spawn to k_thread_create
 * :jira:`ZEP-2274` - Build warnings [-Wpointer-sign] with LLVM/icx (tests/net/ipv6_fragment)
@@ -207,6 +275,8 @@ JIRA Related Items
 * :jira:`ZEP-2306` - echo server hangs from IPv6 hop-by-hop option anomaly
 * :jira:`ZEP-2308` - (New) Networking API details documentation is missing
 * :jira:`ZEP-2310` - Improve configuration documentation index organization
+* :jira:`ZEP-2314` - Testcase failure :tests/benchmarks/timing_info/testcase.ini#test
+* :jira:`ZEP-2316` - Testcase failure :tests/bluetooth/shell/testcase.ini#test_br
 * :jira:`ZEP-2318` - some kernel objects sections are misaligned
 * :jira:`ZEP-2319` - tests/net/ieee802154/l2 uses semaphore before initialization
 * :jira:`ZEP-2321` - [PTS] All TC's of SM/GATT/GAP failed due to BTP_TIMEOUT error.
@@ -218,6 +288,7 @@ JIRA Related Items
 * :jira:`ZEP-2332` - bad memory access tests/net/ip-addr
 * :jira:`ZEP-2334` - bluetooth shell build warning when CONFIG_DEBUG=y
 * :jira:`ZEP-2335` - Ensure the Licensing page is up-to-date for the release
+* :jira:`ZEP-2340` - Disabling advertising gets stuck
 * :jira:`ZEP-2341` - Build warnings:override: reassigning to symbol MAIN_STACK_SIZE with LLVM/icx (/tests/net/6lo)
 * :jira:`ZEP-2343` - Coverity static scan issues seen
 * :jira:`ZEP-2344` - Coverity static scan issues seen
@@ -248,14 +319,16 @@ JIRA Related Items
 * :jira:`ZEP-2397` - net_if_ipv6_addr_rm calls k_delayed_work_cancel() on uninitialized k_delayed_work object
 * :jira:`ZEP-2398` - network stack test cases are only tested on x86
 * :jira:`ZEP-2403` - Enabling MMU for qemu_x86 broke active connect support
-* :jira:`ZEP-2407` - [Cortex m series ] Getting a crash on Cortex m3 series when more than 8 premptive threads with equal priority are scheduled
+* :jira:`ZEP-2407` - [Cortex m series ] Getting a crash on Cortex m3 series when more than 8 preemptive threads with equal priority are scheduled
 * :jira:`ZEP-2408` - design mechanism for kernel object sharing policy
 * :jira:`ZEP-2412` - Bluetooth tester app not working from commit c1e5cb
+* :jira:`ZEP-2423` - samples/bluetooth/ipsp's builtin TCP echo crashes on TCP closure
 * :jira:`ZEP-2432` - ieee802154_shell.c, net_mgmt call leads to a BUS FAULT
 * :jira:`ZEP-2433` - x86: do forensic analysis to determine stack overflow context in supervisor mode
 * :jira:`ZEP-2436` - Unable to see console output in Quark_D200_CRB
 * :jira:`ZEP-2437` - warnings when building applications for quark d2000
 * :jira:`ZEP-2444` - [nrf] Scheduling test API is getting failed in case of nrf51/nrf52 platforms
+* :jira:`ZEP-2445` - nrf52: CPU lock-up when using Bluetooth + Flash driver + CONFIG_ASSERT
 * :jira:`ZEP-2447` - 'make debugserver' fails for qemu_x86_iamcu
 * :jira:`ZEP-2451` - Move Bluetooth IPSP support functions from samples/bluetooth to a separate library
 * :jira:`ZEP-2452` - https server does not build for olimex_stm32_e407
@@ -263,7 +336,9 @@ JIRA Related Items
 * :jira:`ZEP-2459` - Sample application not working with Quark SE C1000
 * :jira:`ZEP-2460` - tests/crypto/ecc_dh fails on qemu_nios2
 * :jira:`ZEP-2464` - "allow IPv6 interface init to work with late IP assignment" patch broke non-late IPv6 assignment
+* :jira:`ZEP-2465` - Static code scan (coverity) issues seen
 * :jira:`ZEP-2467` - Static code scan (coverity) issues seen
+* :jira:`ZEP-2468` - Static code scan (coverity) issues seen
 * :jira:`ZEP-2469` - Static code scan (coverity) issues seen
 * :jira:`ZEP-2474` - Static code scan (coverity) issues seen
 * :jira:`ZEP-2480` - Build warnings [-Wpointer-sign] with LLVM/icx (samples/net/coaps_server)
@@ -275,18 +350,33 @@ JIRA Related Items
 * :jira:`ZEP-2488` - Build warnings [-Wpointer-sign] and [-Warray-bounds] with LLVM/icx (samples/net/irc_bot)
 * :jira:`ZEP-2489` - bug in _x86_mmu_buffer_validate API
 * :jira:`ZEP-2496` - Build failure on tests/benchmarks/object_footprint
+* :jira:`ZEP-2497` - [TIMER] k_timer_start should take 0 value for duration parameter
+* :jira:`ZEP-2498` - [Display] Minimum Duration argument to k_timer_start should be non Zero positive value
 * :jira:`ZEP-2508` - esp32 linkage doesn't unify ELF sections correctly
+* :jira:`ZEP-2510` - BT: CONFIG_BT_HCI_TX_STACK_SIZE appears to be too low for BT_SPI
+* :jira:`ZEP-2514` - XCC sanitycheck build compile wrong targets
 * :jira:`ZEP-2523` - Static code scan (Coverity) issue seen in file: /samples/net/zoap_server/src/zoap-server.c
+* :jira:`ZEP-2525` - Static code scan (Coverity) issue seen in file: /samples/net/zoap_server/src/zoap-server.c
 * :jira:`ZEP-2531` - Static code scan (Coverity) issue seen in file: /tests/net/lib/dns_resolve/src/main.c
 * :jira:`ZEP-2528` - Static code scan (Coverity) issue seen in file: /samples/net/nats/src/nats.c
 * :jira:`ZEP-2534` - Static code scan (Coverity) issue seen in file: /tests/kernel/irq_offload/src/irq_offload.c
 * :jira:`ZEP-2535` - Static code scan (Coverity) issue seen in file: /tests/net/lib/zoap/src/main.c
+* :jira:`ZEP-2537` - Static code scan (Coverity) issue seen in file: /tests/crypto/ecc_dh/src/ecc_dh.c
 * :jira:`ZEP-2538` - Static code scan (Coverity) issue seen in file: /arch/arm/soc/st_stm32/stm32f1/soc_gpio.c
 * :jira:`ZEP-2539` - Static code scan (Coverity) issue seen in file: /tests/net/ieee802154/l2/src/ieee802154_test.c
+* :jira:`ZEP-2540` - Static code scan (Coverity) issue seen in file: /ext/lib/crypto/tinycrypt/source/ecc_dh.c
+* :jira:`ZEP-2541` - Static code scan (Coverity) issue seen in file: /subsys/bluetooth/host/mesh/cfg.c
+* :jira:`ZEP-2549` - Static code scan (Coverity) issue seen in file: /samples/net/leds_demo/src/leds-demo.c
 * :jira:`ZEP-2552` - ESP32 uart poll_out always return 0
 * :jira:`ZEP-2553` - k_queue_poll not handling -EADDRINUSE (another thread already polling) properly
 * :jira:`ZEP-2556` - ESP32 watchdog WDT_MODE_INTERRUPT_RESET mode fails
 * :jira:`ZEP-2557` - ESP32 : Some GPIO tests are getting failed (tests/drivers/gpio/gpio_basic_api)
+* :jira:`ZEP-2558` - CONFIG_BLUETOOTH_* Kconfig options silently ignored
+* :jira:`ZEP-2560` - samples/net: the sample of zoap_server fails to add multicast address
 * :jira:`ZEP-2561` - samples/net: The HTTP client failed to send the POST request
 * :jira:`ZEP-2568` - [PTS] All TC's of L2CAP/SM/GATT/GAP failed due to BTP_ERROR.
 * :jira:`ZEP-2575` - error:[ '-O: command not found'] with LLVM/icx (samples/hello_world)
+* :jira:`ZEP-2576` - samples/net/sockets/echo, echo_async : fails to send the TCP packets
+* :jira:`ZEP-2581` - CC3220 executable binary format support
+* :jira:`ZEP-2584` - Update mbedTLS to 2.6.0
+* :jira:`ZEP-713`  - Implement preemptible regular IRQs on ARC

doc/release-notes.rst

@@ -17,7 +17,7 @@ notes pages listed below), or use Git clone and checkout commands, such as:
 
    git clone https://github.com/zephyrproject-rtos/zephyr
    cd zephyr
-   git checkout tags/v1.8.0
+   git checkout tags/v1.9.0
 
 
 The project's technical documentation is also tagged to correspond with a
@@ -29,6 +29,7 @@ Zephyr Kernel Releases
 .. toctree::
    :maxdepth: 1
 
+   release-notes-1.9
    release-notes-1.8
    release-notes-1.7
    release-notes-1.6

doc/scripts/filter-doc-log.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+
+# run the filter-known-issues.py script to remove "expected" warning
+# messages from the output of the document build process and write
+# the filtered output to stdout
+#
+# Only argument is the name of the log file saved by the build.
+
+KI_SCRIPT=${ZEPHYR_BASE}/scripts/filter-known-issues.py
+CONFIG_DIR=${ZEPHYR_BASE}/.known-issues/doc
+
+LOG_FILE=$1
+
+red='\E[31m'
+green='\e[32m'
+
+if [ -z "${LOG_FILE}" ]; then
+        echo "Error in $0: missing input parameter <logfile>"
+        exit 1
+fi
+
+if [ -s "${LOG_FILE}" ]; then
+   $KI_SCRIPT --config-dir ${CONFIG_DIR} ${LOG_FILE} > doc.warnings 2>&1
+   if [ -s doc.warnings ]; then
+	   echo
+	   echo -e "${red}New errors/warnings found, please fix them:"
+	   echo -e "=============================================="
+	   tput sgr0
+	   echo
+	   cat doc.warnings
+	   echo
+   else
+	   echo -e "${green}No new errors/warnings."
+	   tput sgr0
+   fi
+
+else
+   echo "Error in $0: logfile \"${LOG_FILE}\" not found."
+   exit 1
+fi

doc/scripts/genrest/genrest.py

@@ -47,13 +47,13 @@ def print_items(items, outdir, indent):
                 config = open("%s/%s.rst" % (outdir, var), "w")
                 config.write(":orphan:\n\n")
                 config.write(".. title:: %s\n\n" %item.get_name())
-                config.write(".. option:: CONFIG_%s:\n" %item.get_name())
+                config.write(".. option:: CONFIG_%s\n" %item.get_name())
                 config.write(".. _CONFIG_%s:\n" %item.get_name())
                 if text:
                     config.write("\n%s\n\n" %text)
                 else:
                     config.write("\nThe configuration item %s:\n\n" %var)
-                config.write(item.rest())
+                config.write("%s\n" %item.rest())
 
                 config.close()
         elif item.is_menu():

doc/security/security-overview.rst

@@ -787,5 +787,5 @@ See :ref:`security-citations`
 .. _`STRIDE`: https://msdn.microsoft.com/en-us/library/ee823878%28v=cs.20%29.aspx
 .. _`Zephyr Kernel subsystem documentation`: https://www.zephyrproject.org/doc/subsystems/subsystems.html
 .. _`secure coding guidelines`: https://www.zephyrproject.org/doc/contribute/security.html
-.. _`development model documentation`: https://wiki.zephyrproject.org/view/Development_Model
+.. _`development model documentation`: https://github.com/zephyrproject-rtos/zephyr/wiki/Development-Model
 .. _`CVSS`: https://www.first.org/cvss/specification-document

doc/static/zephyr-custom.css

@@ -1,4 +1,103 @@
-/* -- Extra CSS styles for Zephyr content ----------------------------------- */
+/* -- Extra CSS styles for Zephyr content (RTD theme) ----------------------- */
+
+/* make the page width fill the window */
+.wy-nav-content {
+   max-width: none;
+}
+
+/* pygments tweak for white-on-black console */
+/* hold off on this change for now
+
+.highlight-console .highlight {
+   background-color: black;
+}
+.highlight-console .highlight .go, .highlight-console .highlight .gp {
+   color: white;
+}
+.highlight-console .highlight .hll {
+   background-color: white;
+}
+.highlight-console .highlight .hll .go, .highlight-console .highlight .hll .gp {
+   color: black;
+   font-weight: bold;
+}
+*/
+
+/* tweak doc version selection
+.rst-versions {
+   position: static;
+   border-top: none;
+   padding: 0px;
+}
+*/
+
+.rst-versions .rst-current-version {
+   padding: 5px;
+   background-color: #2980B9;
+   color: #80FF80;
+}
+
+.rst-versions .rst-other-versions {
+   padding: 5px;
+}
+
+div.rst-other-versions dl {
+   margin-bottom: 0;
+}
+
+
+/* code block highlight color in rtd changed to lime green, no no no */
+
+.rst-content tt.literal, .rst-content code.literal, .highlight {
+   background: #f0f0f0;
+}
+.rst-content tt.literal, .rst-content code.literal {
+    color: #000000;
+}
+
+/* Make the version number more visible */
+.wy-side-nav-search>div.version {
+    color: rgba(255,255,255,1);
+}
+
+/* squish the space between a paragraph before a list */
+div > p + ul, div > p + ol {
+   margin-top: -20px;
+}
+
+/* add some space before the figure caption */
+p.caption  {
+#    border-top: 1px solid;
+    margin-top: 1em;
+}
+
+/* decrease line leading a bit, 24px is too wide */
+
+p {
+   line-height: 22px;
+}
+
+/* add a colon after the figure/table number (before the caption) */
+span.caption-number::after {
+   content: ": ";
+}
+
+p.extrafooter {
+   text-align: right;
+   margin-top: -36px;
+}
+
+table.align-center {
+   display: table !important;
+}
+
+
+.code-block-caption {
+    color: #000;
+    font: italic 85%/1 arial,sans-serif;
+    padding: 1em 0;
+    text-align: center;
+}
 
 /*  make .. hlist:: tables fill the page */
 table.hlist {
@@ -9,3 +108,49 @@ table.hlist {
 th,td {
     white-space: normal !important;
 }
+
+/* dbk tweak for doxygen-generated API headings (for RTD theme) */
+.rst-content dl.group>dt, .rst-content dl.group>dd>p {
+   display:none !important;
+}
+.rst-content dl.group {
+  margin: 0 0 12px 0px;
+}
+.rst-content dl.group>dd {
+  margin-left: 0  !important;
+}
+.rst-content p.breathe-sectiondef-title {
+  text-decoration: underline;  /* dbk for API sub-headings */
+  font-size: 1.25rem;
+  font-weight: bold;
+  margin-bottom: 12px;
+}
+.rst-content div.breathe-sectiondef {
+  padding-left: 0 !important;
+}
+
+/* tweak display of option tables to make first column wider */
+col.option {
+  width: 25%;
+}
+
+/* tweak format for <kbd> (:kbd:`F10`) */
+kbd
+{
+  -moz-border-radius:3px;
+  -moz-box-shadow:0 1px 0 rgba(0,0,0,0.2),0 0 0 2px #fff inset;
+  -webkit-border-radius:3px;
+  -webkit-box-shadow:0 1px 0 rgba(0,0,0,0.2),0 0 0 2px #fff inset;
+  background-color:#f7f7f7;
+  border:1px solid #ccc;
+  border-radius:3px;
+  box-shadow:0 1px 0 rgba(0,0,0,0.2),0 0 0 2px #fff inset;
+  color:#333;
+  display:inline-block;
+  font-family:Arial,Helvetica,sans-serif;
+  font-size:11px;
+  line-height:1.4;
+  margin:0 .1em;
+  padding:.1em .6em;
+  text-shadow:0 1px 0 #fff;
+}

doc/static/zephyr-custom.js

@@ -0,0 +1,6 @@
+/* tweak logo link to the project home page in a new tab*/
+
+$(document).ready(function(){
+   $( ".icon-home" ).attr("href", "https://zephyrproject.org/");
+   $( ".icon-home" ).attr("target", "_blank");
+});

doc/subsystems/bluetooth/gap-pics.rst

@@ -1,7 +1,7 @@
 GAP PICS
 ########
 
-PTS version: 6.4
+PTS version: 7.0.1
 
 \* - different than PTS defaults
 
@@ -34,6 +34,7 @@ TSPC_GAP_0A_1	False (*)	Core Specification Addendum 3 (CSA3) (C.1)
 TSPC_GAP_0A_2	False (*)	Core Specification Addendum 4 (CSA4) (C.2)
 TSPC_GAP_0A_3	False (*)	Core Spec version 4.1 (Core v4.1) (C.3)
 TSPC_GAP_0A_4	True		Core Spec version 4.2 (Core v4.2) (C.4)
+TSPC_GAP_0A_5	False (*)	Core Spec version 5.0 (Core v5.0) (C.4)
 ==============	==============	=======================================
 
 
@@ -152,6 +153,10 @@ Parameter Name	Selected	Description
 ==============	==============	=======================================
 TSPC_GAP_8_1	True		Non-Connectable Undirected Event (M)
 TSPC_GAP_8_2	True		Scannable Undirected Event (O)
+TSPC_GAP_8_3	False (*)	Non-Connectable and Non-Scannable
+				Directed Event (C.1)
+TSPC_GAP_8_4	False (*)	Scannable Directed Event (C.1)
+
 ==============	==============	=======================================
 
 
@@ -178,7 +183,7 @@ TSPC_GAP_8A_13	False (*)	AD Type-Random Target Address (O)
 TSPC_GAP_8A_14	False (*)	AD Type-Advertising Interval (O)
 TSPC_GAP_8A_15	False (*)	AD Type-LE Bluetooth Device Address (O)
 TSPC_GAP_8A_16	False (*)	AD Type-LE Role (O)
-TSPC_GAP_8A_17	(^)		AD Type-URI (C.3)
+TSPC_GAP_8A_17	False (*)	AD Type-URI (C.3)
 ==============	==============	=======================================
 
 
@@ -208,16 +213,28 @@ Broadcaster Privacy Feature
 ==============	==============	=======================================
 Parameter Name	Selected	Description
 ==============	==============	=======================================
-TSPC_GAP_11_1	False (*)	Privacy Feature v1.0 (C.2)
+TSPC_GAP_11_1	True		Privacy Feature v1.0 (C.2)
 TSPC_GAP_11_1A	False (*)	Privacy Feature v1.1 (C.3)
 TSPC_GAP_11_1B	(^)		Privacy Feature v1.2 (C.5)
-TSPC_GAP_11_2	False (*)	Resolvable Private Address Generation
+TSPC_GAP_11_2	True		Resolvable Private Address Generation
 				Procedure (C.1)
 TSPC_GAP_11_3	False (*)	Non-Resolvable Private Address Generation
 				Procedure (C.4)
 ==============	==============	=======================================
 
 
+Periodic Advertising Modes and Procedures
+*****************************************
+
+==============	==============	=======================================
+Parameter Name	Selected	Description
+==============	==============	=======================================
+TSPC_GAP_11A_1	False (*)	Periodic Advertising Synchronizability
+				mode (C.1)
+TSPC_GAP_11A_2	False (*)	Periodic Advertising mode  (C.2)
+==============	==============	=======================================
+
+
 Observer Physical Layer
 ***********************
 
@@ -277,18 +294,33 @@ Observer Privacy Feature
 ==============	==============	=======================================
 Parameter Name	Selected	Description
 ==============	==============	=======================================
-TSPC_GAP_17_1	False (*)	Privacy Feature v1.0 (C.4)
+TSPC_GAP_17_1	True		Privacy Feature v1.0 (C.4)
 TSPC_GAP_17_1A	False (*)	Privacy Feature v1.1 (C.5)
 TSPC_GAP_17_1B	(^)		Privacy Feature v1.2 (C.6)
 TSPC_GAP_17_2	False (*)	Non-Resolvable Private Address Generation
 				Procedure (C.1)
-TSPC_GAP_17_3	False (*)	Resolvable Private Address Resolution
+TSPC_GAP_17_3	True		Resolvable Private Address Resolution
 				Procedure (C.2)
-TSPC_GAP_17_4	False (*)	Resolvable Private Address Generation
+TSPC_GAP_17_4	True		Resolvable Private Address Generation
 				Procedure (C.3)
 ==============	==============	=======================================
 
 
+Periodic Advertising Modes and Procedures
+*****************************************
+
+==============	==============	=======================================
+Parameter Name	Selected	Description
+==============	==============	=======================================
+TSPC_GAP_17A_1	False (*)	Periodic Advertising Synchronization
+				Establishment procedure without listening
+				for periodic advertising (C.1)
+TSPC_GAP_17A_2	False (*)	Periodic Advertising Synchronization
+				Establishment procedure with listening for
+				periodic advertising (C.1)
+==============	==============	=======================================
+
+
 Peripheral Physical Layer
 *************************
 
@@ -320,8 +352,12 @@ Parameter Name	Selected	Description
 ==============	==============	=======================================
 TSPC_GAP_20_1	True		Connectable Undirected Event (C.1)
 TSPC_GAP_20_2	True		Connectable Directed Event (C.2)
+TSPC_GAP_20_2A	False (*)	Peripheral: Low Duty Directed Advertising
 TSPC_GAP_20_3	True		Non-Connectable Undirected Event (O)
 TSPC_GAP_20_4	True		Scannable Undirected Event (O)
+TSPC_GAP_20_5	False (*)	Connectable Undirected Event (C.3)
+TSPC_GAP_20_6	False (*)	Non-Connectable and Non-Scannable Directed Event (C.3)
+TSPC_GAP_20_7	False (*)	Scannable Directed Event (C.3)
 ==============	==============	=======================================
 
 
@@ -348,7 +384,7 @@ TSPC_GAP_20A_13	False (*)	AD Type-Random Target Address (C.1)
 TSPC_GAP_20A_14	False (*)	AD Type-Advertising Interval (C.1)
 TSPC_GAP_20A_15	False (*)	AD Type-LE Bluetooth Device Address (C.1)
 TSPC_GAP_20A_16	False (*)	AD Type-LE Role (C.1)
-TSPC_GAP_20A_17	(^)		AD Type-URI (C.4)
+TSPC_GAP_20A_17	False (*)	AD Type-URI (C.4)
 ===============	=============	=======================================
 
 
@@ -427,8 +463,8 @@ TSPC_GAP_25_7	True		Authenticated Pairing
 				(LE security mode 1 level 3) (C.1)
 TSPC_GAP_25_8	True		Unauthenticated Pairing
 				(LE security mode 1 level 2) (C.1)
-TSPC_GAP_25_9	(^)		LE Security Mode 1 Level 4 (C.3)
-TSPC_GAP_25_10	(^)		Secure Connections Only Mode  (C.4)
+TSPC_GAP_25_9	True		LE Security Mode 1 Level 4 (C.3)
+TSPC_GAP_25_10	False (*)	Secure Connections Only Mode  (C.4)
 ==============	==============	=======================================
 
 
@@ -438,14 +474,14 @@ Peripheral Privacy Feature
 ==============	==============	=======================================
 Parameter Name	Selected	Description
 ==============	==============	=======================================
-TSPC_GAP_26_1	False (*)	Privacy Feature (C.5)
+TSPC_GAP_26_1	True		Privacy Feature (C.5)
 TSPC_GAP_26_1A	False (*)	Privacy Feature v1.1 (C.3)
 TSPC_GAP_26_1B	(^)		Privacy Feature v1.2 (C.6)
-TSPC_GAP_26_2	False (*)	Non-Resolvable Private Address Generation
+TSPC_GAP_26_2	True		Non-Resolvable Private Address Generation
 				Procedure (C.1)
-TSPC_GAP_26_3	False (*)	Resolvable Private Address Generation
+TSPC_GAP_26_3	True		Resolvable Private Address Generation
 				Procedure (C.2)
-TSPC_GAP_26_4	False (*)	Resolvable Private Address Generation
+TSPC_GAP_26_4	True		Resolvable Private Address Generation
 				Procedure (C.4)
 ==============	==============	=======================================
 
@@ -462,9 +498,10 @@ TSPC_GAP_27_3	False (*)	Peripheral Privacy Flag (C.1)
 TSPC_GAP_27_4	False (*)	Reconnection Address (C.2)
 TSPC_GAP_27_5	False (*)	Peripheral Preferred Connection Parameters
 				(C.3)
-TSPC_GAP_27_6	True		Writable Device Name (C.3)
-TSPC_GAP_27_7	True		Writable Appearance (C.3)
+TSPC_GAP_27_6	False (*)	Writable Device Name (C.3)
+TSPC_GAP_27_7	False (*)	Writable Appearance (C.3)
 TSPC_GAP_27_8	False (*)	Writable Peripheral Privacy Flag (C.4)
+TSPC_GAP_27_9	False (*)	Central Address Resolution (C.5)
 ==============	==============	=======================================
 
 
@@ -578,8 +615,8 @@ TSPC_GAP_35_7	True		Authenticated Pairing
 				(LE security mode 1 level 3) (C.1)
 TSPC_GAP_35_8	True		Unauthenticated Pairing
 				(LE security mode 1 level 2) (C.1)
-TSPC_GAP_35_9	(^)		LE Security Mode 1 Level 4 (C.2)
-TSPC_GAP_35_10	(^)		Secure Connections Only Mode  (C.3)
+TSPC_GAP_35_9	True		LE Security Mode 1 Level 4 (C.2)
+TSPC_GAP_35_10	True		Secure Connections Only Mode  (C.3)
 ==============	==============	=======================================
 
 
@@ -589,16 +626,16 @@ Central Privacy Feature
 ==============	==============	=======================================
 Parameter Name	Selected	Description
 ==============	==============	=======================================
-TSPC_GAP_36_1	False (*)	Privacy Feature v1.0 (C.2)
+TSPC_GAP_36_1	True		Privacy Feature v1.0 (C.2)
 TSPC_GAP_36_1A	False (*)	Privacy Feature v1.1 (C.4)
 TSPC_GAP_36_1B	(^)		Privacy Feature v1.2 (C.7)
 TSPC_GAP_36_2	False (*)	Non-Resolvable Private Address Generation
 				Procedure (C.1)
-TSPC_GAP_36_3	False (*)	Resolvable Private Address Resolution
+TSPC_GAP_36_3	True		Resolvable Private Address Resolution
 				Procedure (C.3)
 TSPC_GAP_36_4	False (*)	Write to Privacy Characteristic
 				(Enable/Disable Privacy) (C.5)
-TSPC_GAP_36_5	False (*)	Resolvable Private Address Generation
+TSPC_GAP_36_5	True		Resolvable Private Address Generation
 				Procedure (C.6)
 ==============	==============	=======================================
 
@@ -611,7 +648,7 @@ Parameter Name	Selected	Description
 ==============	==============	=======================================
 TSPC_GAP_37_1	True		Device Name (M)
 TSPC_GAP_37_2	True		Appearance (M)
-TSPC_GAP_37_3	(^)		Central Address Resolution  (C.1)
+TSPC_GAP_37_3	True		Central Address Resolution  (C.1)
 ==============	==============	=======================================
 
 
@@ -664,6 +701,8 @@ Central BR/EDR/LE Security Aspects
 Parameter Name	Selected	Description
 ==============	==============	=======================================
 TSPC_GAP_41_1	False (*)	Security Aspects (M)
+TSPC_GAP_41_2A	False (*)	Derivation of BR/EDR Link Key from LE LTK (C.1)
+TSPC_GAP_41_2B	False (*)	Derivation of LE LTK from BR/EDR Link Key (C.1)
 TSPC_GAP_41_2	(^)		Cross-Transport Key Derivation (C.1)
 ==============	==============	=======================================
 
@@ -690,6 +729,8 @@ Peripheral BR/EDR/LE Security Aspects
 Parameter Name	Selected	Description
 ==============	==============	=======================================
 TSPC_GAP_43_1	False (*)	Peripheral BR/EDR/LE: Non-Discoverable Mode
+TSPC_GAP_43_2A	False (*)	Derivation of BR/EDR Link Key from LE LTK (C.1)
+TSPC_GAP_43_2B	False (*)	Derivation of LE LTK from BR/EDR Link Key (C.1)
 TSPC_GAP_43_2	(^)		Cross-Transport Key Derivation (C.1)
 ==============	==============	=======================================
 

doc/subsystems/bluetooth/gatt-pics.rst

@@ -1,7 +1,7 @@
 GATT PICS
 #########
 
-PTS version: 6.4
+PTS version: 7.0.1
 
 \* - different than PTS defaults
 
@@ -73,6 +73,7 @@ TSPC_GATT_3_21	True		Client: Write Characteristic Descriptors (C.1)
 TSPC_GATT_3_22	True		Client: Write Long Characteristic Descriptors
 				(C.1)
 TSPC_GATT_3_23	True		Client: Service Changed Characteristic (M)
+TSPC_GATT_3_24	False (*)	Client: Configured Broadcast (C.3)
 ==============	===========	============================================
 
 
@@ -155,7 +156,7 @@ TSPC_GATT_4_15	True		Server: Write Long Characteristic Values (C.4)
 TSPC_GATT_4_16	True		Server: Characteristic Value Reliable
 				Writes (C.4)
 TSPC_GATT_4_17	True		Server: Notifications (C.4)
-TSPC_GATT_4_18	False (*)	Server: Indications (C.1)
+TSPC_GATT_4_18	True		Server: Indications (C.1)
 TSPC_GATT_4_19	True		Server: Read Characteristic Descriptors (C.4)
 TSPC_GATT_4_20	True		Server: Read long Characteristic
 				Descriptors (C.4)
@@ -163,6 +164,8 @@ TSPC_GATT_4_21	True		Server: Write Characteristic Descriptors (C.4)
 TSPC_GATT_4_22	True		Server: Write Long Characteristic
 				Descriptors (C.4)
 TSPC_GATT_4_23	False (*)	Server: Service Changed Characteristic (C.1)
+TSPC_GATT_4_24	False (*)	Server: Configured Broadcast (C.5)
+TSPC_GATT_4_25	False (*)	Server: Execute Write Request with empty queue (C.7)
 ==============	===========	============================================
 
 
@@ -246,68 +249,14 @@ TSPC_GATT_7_7	True		LE Authorization Procedure (C.2)
 ==============	===========	============================================
 
 
-Attribute Protocol Client Messages
-**********************************
-
-==============	===========	============================================
-Parameter Name	Selected	Description
-==============	===========	============================================
-TSPC_ATT_3_1	False (*)	Attribute Error Response (M)
-TSPC_ATT_3_2	False (*)	Exchange MTU Request (O)
-TSPC_ATT_3_4	False (*)	Find Information Request (O)
-TSPC_ATT_3_6	False (*)	Find by Type Value Request (O)
-TSPC_ATT_3_8	False (*)	Read by Type Request (O)
-TSPC_ATT_3_10	False (*)	Read Request (O)
-TSPC_ATT_3_12	False (*)	Read Blob Request (O)
-TSPC_ATT_3_14	False (*)	Read Multiple Request (O)
-TSPC_ATT_3_16	False (*)	Read by Group Type Request (O)
-TSPC_ATT_3_17	False (*)	Read by Group Type Response (C.6)
-TSPC_ATT_3_18	False (*)	Write Request (O)
-TSPC_ATT_3_20	False (*)	Write Command (O)
-TSPC_ATT_3_21	False (*)	Signed Write Command (O)
-TSPC_ATT_3_22	False (*)	Prepare Write Request (O)
-TSPC_ATT_3_24	False (*)	Execute Write Request (C.8)
-TSPC_ATT_3_26	False (*)	Handle Value Notification (M)
-TSPC_ATT_3_28	False (*)	Handle Value Confirmation (M)
-==============	===========	============================================
-
-
-Attribute Protocol Server Messages
-**********************************
-
-==============	===========	============================================
-Parameter Name	Selected	Description
-==============	===========	============================================
-TSPC_ATT_4_1	True		Attribute Error Response (M)
-TSPC_ATT_4_2	True		Exchange MTU Request (M)
-TSPC_ATT_4_3	True		Exchange MTU Response (M)
-TSPC_ATT_4_5	True		Find Information Response (M)
-TSPC_ATT_4_7	True		Find by Type Value Response (M)
-TSPC_ATT_4_8	True		Read by Type Request (M)
-TSPC_ATT_4_9	False (*)	Read by Type Response (M)
-TSPC_ATT_4_11	True		Read Response (M)
-TSPC_ATT_4_13	False (*)	Read Blob Response (C.1)
-TSPC_ATT_4_15	False (*)	Read Multiple Response (C.2)
-TSPC_ATT_4_17	True		Read by Group Type Response (M)
-TSPC_ATT_4_19	False (*)	Write Response (C.3)
-TSPC_ATT_4_20	False (*)	Write Command (O)
-TSPC_ATT_4_21	False (*)	Signed Write Command (O)
-TSPC_ATT_4_23	False (*)	Prepare Write Response (C.4)
-TSPC_ATT_4_25	False (*)	Execute Write Response (C.4)
-TSPC_ATT_4_26	False (*)	Handle Value Notification (O)
-TSPC_ATT_4_27	False (*)	Handle Value Indication (O)
-==============	===========	============================================
-
-
 Attribute Protocol Transport
 ****************************
 
 ==============	===========	============================================
 Parameter Name	Selected	Description
 ==============	===========	============================================
-TSPC_ATT_5_2	True		LE Security Mode 1 (C.2)
-TSPC_ATT_5_4	True		LE Authentication Procedure (C.2)
-TSPC_ATT_5_7	True		LE Authorization Procedure (C.2)
+TSPC_GATT_8_1	False (*)	Support for Multiple ATT bearers from same
+				device (C.1)
 ==============	===========	============================================
 
 

doc/subsystems/bluetooth/l2cap-pics.rst

@@ -1,7 +1,7 @@
 L2CAP PICS
 ##########
 
-PTS version: 6.4
+PTS version: 7.0.1
 
 * - different than PTS defaults
 

doc/subsystems/bluetooth/sm-pics.rst

@@ -1,7 +1,7 @@
 SM PICS
 #######
 
-PTS version: 6.4
+PTS version: 7.0.1
 
 \* - different than PTS defaults
 
@@ -33,7 +33,7 @@ TSPC_SM_2_1	True		Authenticated MITM protection (O)
 TSPC_SM_2_2	True		Unauthenticated no MITM protection (C.1)
 TSPC_SM_2_3	True		No security requirements (M)
 TSPC_SM_2_4	False		OOB supported (O)
-TSPC_SM_2_5	(^)		LE Secure Connections (C.2)
+TSPC_SM_2_5	True		LE Secure Connections (C.2)
 ===============	===========	=======================================
 
 
@@ -90,6 +90,6 @@ Key Distribution
 Parameter Name	Selected	Description
 ===============	===========	=======================================
 TSPC_SM_7_1	True		Encryption Key (C.1)
-TSPC_SM_7_2	False (*)	Identity Key (C.2)
+TSPC_SM_7_2	True		Identity Key (C.2)
 TSPC_SM_7_3	True		Signing Key (C.3)
 ===============	===========	=======================================

doc/zephyr.doxyfile

@@ -116,7 +116,11 @@ RECURSIVE              = YES
 EXCLUDE                =
 EXCLUDE_SYMLINKS       =
 EXCLUDE_PATTERNS       =
-EXCLUDE_SYMBOLS        =
+
+# Hide internal names (starting with an underscore, and doxygen-generated names
+# for nested unnamed unions that don't generate meaningful sphinx output anyway.
+EXCLUDE_SYMBOLS        = _*  *.__unnamed__
+
 EXAMPLE_PATH           =
 EXAMPLE_PATTERNS       =
 EXAMPLE_RECURSIVE      = YES
@@ -279,9 +283,14 @@ PREDEFINED             = "CONFIG_SYS_CLOCK_EXISTS=y" \
 			 "CONFIG_DEVICE_POWER_MANAGEMENT=y" \
 			 "CONFIG_BT_SMP=y" \
 			 "CONFIG_BT_BREDR=y" \
-			 "__deprecated=" \
-			 "__printf_like(x, y)=" \
-			 "__attribute(x)__="
+                         "NET_MGMT_DEFINE_REQUEST_HANDLER(x)=" \
+                         "__deprecated=" \
+                         "__packed=" \
+                         "__aligned(x)=" \
+                         "__printf_like(x, y)=" \
+                         "__attribute__(x)=" \
+                         "__syscall=" \
+                         "__syscall_inline="
 EXPAND_AS_DEFINED      =
 SKIP_FUNCTION_MACROS   = NO
 #---------------------------------------------------------------------------

drivers/pwm/pwm_stm32.c

@@ -38,7 +38,13 @@ static u32_t __get_tim_clk(u32_t bus_clk,
 		apb_psc = CONFIG_CLOCK_STM32_APB2_PRESCALER;
 	}
 
-	if (apb_psc == RCC_HCLK_DIV1) {
+	/*
+	 * If the APB prescaler equals 1, the timer clock frequencies
+	 * are set to the same frequency as that of the APB domain.
+	 * Otherwise, they are set to twice (×2) the frequency of the
+	 * APB domain.
+	 */
+	if (apb_psc == 1) {
 		tim_clk = bus_clk;
 	} else	{
 		tim_clk = 2 * bus_clk;

drivers/sensor/Kconfig

@@ -56,6 +56,8 @@ source "drivers/sensor/bmg160/Kconfig"
 
 source "drivers/sensor/bmi160/Kconfig"
 
+source "drivers/sensor/bmm150/Kconfig"
+
 source "drivers/sensor/dht/Kconfig"
 
 source "drivers/sensor/fxas21002/Kconfig"

drivers/sensor/Makefile

@@ -8,6 +8,7 @@ obj-$(CONFIG_BMC150_MAGN) += bmc150_magn/
 obj-$(CONFIG_BME280) += bme280/
 obj-$(CONFIG_BMG160) += bmg160/
 obj-$(CONFIG_BMI160) += bmi160/
+obj-$(CONFIG_BMM150) += bmm150/
 obj-$(CONFIG_DHT) += dht/
 obj-$(CONFIG_FXAS21002) += fxas21002/
 obj-$(CONFIG_FXOS8700) += fxos8700/

drivers/sensor/bmm150/Kconfig

@@ -0,0 +1,74 @@
+# Kconfig - BMM150 Geomagnetic sensor configuration options
+
+#
+# Copyright (c) 2017 Intel Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+menuconfig BMM150
+	bool "BMM150 I2C Geomagnetic Chip"
+	depends on SENSOR && I2C
+	default n
+	help
+	  Enable driver for BMM150 I2C-based Geomagnetic sensor.
+if BMM150
+
+config BMM150_DEV_NAME
+	string "BMM150 device name"
+	default "bmm150"
+
+config BMM150_I2C_ADDR
+	hex "BMM150 I2C slave address"
+	default 0x10
+	help
+	  Specify the I2C slave address for the BMM150.
+	  Possible addresses are 0x10,0x11,0x12,0x13.
+
+config BMM150_I2C_MASTER_DEV_NAME
+	string "I2C master where BMM150 is connected"
+	default "I2C_0"
+	help
+	  Specify the device name of the I2C master device to which BMM150
+	  is connected.
+
+choice
+	prompt "Default preset"
+	default BMM150_PRESET_REGULAR
+	help
+	  Specify the default preset (x/y oversampling, z oversampling, sampling
+	  frequency).
+
+config BMM150_PRESET_LOW_POWER
+	bool "Low power (3, 3, 10)"
+
+config BMM150_PRESET_REGULAR
+	bool "Regular (9, 15, 10)"
+
+config BMM150_PRESET_ENHANCED_REGULAR
+	bool "Enhanced regular (15, 27, 10)"
+
+config BMM150_PRESET_HIGH_ACCURACY
+	bool "High accuracy (47, 83, 20)"
+
+endchoice
+
+config BMM150_SAMPLING_RATE_RUNTIME
+	bool "Enable dynamic sampling rate"
+	default n
+	help
+	  Enable alteration of sampling rate attribute at runtime.
+
+config BMM150_SAMPLING_REP_XY
+	bool "Enable dynamic XY oversampling"
+	default n
+	help
+	  Enable alteration of XY oversampling at runtime.
+
+config BMM150_SAMPLING_REP_Z
+	bool "Enable dynamic Z oversampling"
+	default n
+	help
+	  Enable alteration of Z oversampling at runtime.
+
+endif # BMM150

drivers/sensor/bmm150/Makefile

@@ -0,0 +1 @@
+obj-$(CONFIG_BMM150) += bmm150.o

drivers/sensor/bmm150/bmm150.c

@@ -0,0 +1,606 @@
+/* bmm150.c - Driver for Bosch BMM150 Geomagnetic Sensor */
+
+/*
+ * Copyright (c) 2017 Intel Corporation
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include "bmm150.h"
+
+static const struct {
+	int freq;
+	u8_t reg_val;
+} bmm150_samp_freq_table[] = { { 2, 0x01 },
+			       { 6, 0x02 },
+			       { 8, 0x03 },
+			       { 10, 0x00 },
+			       { 15, 0x04 },
+			       { 20, 0x05 },
+			       { 25, 0x06 },
+			       { 30, 0x07 } };
+
+static const struct bmm150_preset {
+	u8_t rep_xy;
+	u8_t rep_z;
+	u8_t odr;
+} bmm150_presets_table[] = {
+	[BMM150_LOW_POWER_PRESET] = { 3, 3, 10 },
+	[BMM150_REGULAR_PRESET] = { 9, 15, 10 },
+	[BMM150_ENHANCED_REGULAR_PRESET] = { 15, 27, 10 },
+	[BMM150_HIGH_ACCURACY_PRESET] = { 47, 83, 20 }
+};
+
+static int bmm150_set_power_mode(struct device *dev,
+				 enum bmm150_power_modes mode,
+				 int state)
+{
+	struct bmm150_data *data = dev->driver_data;
+	const struct bmm150_config *config = dev->config->config_info;
+
+	switch (mode) {
+	case BMM150_POWER_MODE_SUSPEND:
+		if (i2c_reg_update_byte(data->i2c,
+					config->i2c_slave_addr,
+					BMM150_REG_POWER,
+					BMM150_MASK_POWER_CTL,
+					!state) < 0) {
+			return -EIO;
+		}
+		k_busy_wait(5 * USEC_PER_MSEC);
+
+		return 0;
+	case BMM150_POWER_MODE_SLEEP:
+		return i2c_reg_update_byte(data->i2c,
+					   config->i2c_slave_addr,
+					   BMM150_REG_OPMODE_ODR,
+					   BMM150_MASK_OPMODE,
+					   BMM150_MODE_SLEEP <<
+					   BMM150_SHIFT_OPMODE);
+		break;
+	case BMM150_POWER_MODE_NORMAL:
+		return i2c_reg_update_byte(data->i2c,
+					   config->i2c_slave_addr,
+					   BMM150_REG_OPMODE_ODR,
+					   BMM150_MASK_OPMODE,
+					   BMM150_MODE_NORMAL <<
+					   BMM150_SHIFT_OPMODE);
+		break;
+	}
+
+	return -ENOTSUP;
+
+}
+
+static int bmm150_set_odr(struct device *dev, u8_t val)
+{
+	struct bmm150_data *data = dev->driver_data;
+	const struct bmm150_config *config = dev->config->config_info;
+	u8_t i;
+
+	for (i = 0; i < ARRAY_SIZE(bmm150_samp_freq_table); ++i) {
+		if (val <= bmm150_samp_freq_table[i].freq) {
+			return i2c_reg_update_byte(data->i2c,
+						   config->i2c_slave_addr,
+						   BMM150_REG_OPMODE_ODR,
+						   BMM150_MASK_ODR,
+						   (bmm150_samp_freq_table[i].
+						    reg_val <<
+						    BMM150_SHIFT_ODR));
+		}
+	}
+	return -ENOTSUP;
+}
+
+#if defined(BMM150_SET_ATTR)
+static int bmm150_read_rep_xy(struct device *dev)
+{
+	struct bmm150_data *data = dev->driver->data;
+	const struct bmm150_config *config = dev->config->config_info;
+	u8_t reg_val;
+
+	if (i2c_reg_read_byte(data->i2c, config->i2c_slave_addr,
+			      BMM150_REG_REP_XY, &reg_val) < 0) {
+		return -EIO;
+	}
+
+	data->rep_xy = BMM150_REGVAL_TO_REPXY((u8_t)(reg_val));
+
+	return 0;
+}
+
+static int bmm150_read_rep_z(struct device *dev)
+{
+	struct bmm150_data *data = dev->driver_data;
+	const struct bmm150_config *config = dev->config->config_info;
+	u8_t reg_val;
+
+	if (i2c_reg_read_byte(data->i2c, config->i2c_slave_addr,
+			      BMM150_REG_REP_Z, &reg_val) < 0) {
+		return -EIO;
+	}
+
+	data->rep_z = BMM150_REGVAL_TO_REPZ((int)(reg_val));
+
+	return 0;
+}
+
+static int bmm150_compute_max_odr(struct device *dev, int rep_xy,
+				  int rep_z, int *max_odr)
+{
+	struct bmm150_data *data = dev->driver_data;
+
+	if (rep_xy == 0) {
+		if (data->rep_xy <= 0) {
+			if (bmm150_read_rep_xy(dev) < 0) {
+				return -EIO;
+			}
+		}
+		rep_xy = data->rep_xy;
+	}
+
+	if (rep_z == 0) {
+		if (data->rep_z <= 0) {
+			if (bmm150_read_rep_z(dev) < 0) {
+				return -EIO;
+			}
+		}
+		rep_z = data->rep_z;
+	}
+
+	/* Equation reference Datasheet 4.2.4 */
+	*max_odr = 1000000 / (145 * rep_xy + 500 * rep_z + 980);
+
+	return 0;
+}
+#endif
+
+#if defined(BMM150_SET_ATTR_REP)
+static int bmm150_read_odr(struct device *dev)
+{
+	struct bmm150_data *data = dev->driver_data;
+	const struct bmm150_config *config = dev->config->config_info;
+	u8_t i, odr_val, reg_val;
+
+	if (i2c_reg_read_byte(data->i2c, config->i2c_slave_addr,
+			      BMM150_REG_OPMODE_ODR, &reg_val) < 0) {
+		return -EIO;
+	}
+
+	odr_val = (reg_val & BMM150_MASK_ODR) >> BMM150_SHIFT_ODR;
+
+	for (i = 0; i < ARRAY_SIZE(bmm150_samp_freq_table); ++i) {
+		if (bmm150_samp_freq_table[i].reg_val == odr_val) {
+			data->odr = bmm150_samp_freq_table[i].freq;
+			return 0;
+		}
+	}
+
+	return -ENOTSUP;
+}
+#endif
+
+#if defined(CONFIG_BMM150_SAMPLING_REP_XY)
+static int bmm150_write_rep_xy(struct device *dev, int val)
+{
+	struct bmm150_data *data = dev->driver_data;
+	const struct bmm150_config *config = dev->config->config_info;
+
+	if (i2c_reg_update_byte(data->i2c, config->i2c_slave_addr,
+				BMM150_REG_REP_XY,
+				BMM150_REG_REP_DATAMASK,
+				BMM150_REPXY_TO_REGVAL(val)) < 0) {
+		return -EIO;
+	}
+
+	data->rep_xy = val;
+
+	return 0;
+}
+#endif
+
+#if defined(CONFIG_BMM150_SAMPLING_REP_Z)
+static int bmm150_write_rep_z(struct device *dev, int val)
+{
+	struct bmm150_data *data = dev->driver_data;
+	const struct bmm150_config *config = dev->config->config_info;
+
+	if (i2c_reg_update_byte(data->i2c, config->i2c_slave_addr,
+				BMM150_REG_REP_Z,
+				BMM150_REG_REP_DATAMASK,
+				BMM150_REPZ_TO_REGVAL(val)) < 0) {
+		return -EIO;
+	}
+
+	data->rep_z = val;
+
+	return 0;
+}
+#endif
+
+/* Reference Datasheet 4.3.2 */
+static s32_t bmm150_compensate_xy(struct bmm150_trim_regs *tregs,
+				  s16_t xy, uint16_t rhall, bool is_x)
+{
+	s8_t txy1, txy2;
+	s16_t val;
+	u16_t prevalue;
+	s32_t temp1, temp2, temp3;
+
+	if (xy == BMM150_XY_OVERFLOW_VAL) {
+		return INT32_MIN;
+	}
+
+	if (!rhall) {
+		rhall = tregs->xyz1;
+	}
+
+	if (is_x) {
+		txy1 = tregs->x1;
+		txy2 = tregs->x2;
+	} else {
+		txy1 = tregs->y1;
+		txy2 = tregs->y2;
+	}
+
+	prevalue = (u16_t)((((s32_t)tregs->xyz1) << 14) / rhall);
+
+	val = (s16_t)((prevalue) - ((u16_t)0x4000));
+
+	temp1 = (((s32_t)tregs->xy2) * ((((s32_t)val) * ((s32_t)val)) >> 7));
+
+	temp2 = ((s32_t)val) * ((s32_t)(((s16_t)tregs->xy1) << 7));
+
+	temp3 = (((((temp1 + temp2) >> 9) +
+		((s32_t)0x100000)) * ((s32_t)(((s16_t)txy2) +
+		((s16_t)0xA0)))) >> 12);
+
+	val = ((s16_t)((((s32_t)xy) * temp3) >> 13)) + (((s16_t)txy1) << 3);
+
+	return (int32_t)val;
+}
+
+static s32_t bmm150_compensate_z(struct bmm150_trim_regs *tregs,
+				 s16_t z, u16_t rhall)
+{
+	s32_t val, temp1, temp2;
+	s16_t temp3;
+
+	if (z == BMM150_Z_OVERFLOW_VAL) {
+		return INT32_MIN;
+	}
+
+	temp1 = (((s32_t)(z - tregs->z4)) << 15);
+
+	temp2 = ((((s32_t)tregs->z3) *
+		((s32_t)(((s16_t)rhall) - ((s16_t)tregs->xyz1)))) >> 2);
+
+	temp3 = ((s16_t)(((((s32_t)tregs->z1) *
+		((((s16_t)rhall) << 1))) + (1 << 15)) >> 16));
+
+	val = ((temp1 - temp2) / (tregs->z2 + temp3));
+
+	return val;
+}
+
+static int bmm150_sample_fetch(struct device *dev, enum sensor_channel chan)
+{
+
+	struct bmm150_data *drv_data = dev->driver_data;
+	const struct bmm150_config *config = dev->config->config_info;
+	u16_t values[BMM150_AXIS_XYZR_MAX];
+	s16_t raw_x, raw_y, raw_z;
+	u16_t rhall;
+
+	__ASSERT_NO_MSG(chan == SENSOR_CHAN_ALL ||
+			chan == SENSOR_CHAN_MAGN_ANY);
+
+	if (i2c_burst_read(drv_data->i2c, config->i2c_slave_addr,
+			   BMM150_REG_X_L, (u8_t *)values,
+			   sizeof(values)) < 0) {
+		SYS_LOG_ERR("failed to read sample");
+		return -EIO;
+	}
+
+	raw_x = (s16_t)sys_le16_to_cpu(values[BMM150_AXIS_X]) >>
+		BMM150_SHIFT_XY_L;
+	raw_y = (s16_t)sys_le16_to_cpu(values[BMM150_AXIS_Y]) >>
+		BMM150_SHIFT_XY_L;
+	raw_z = (s16_t)sys_le16_to_cpu(values[BMM150_AXIS_Z]) >>
+		BMM150_SHIFT_Z_L;
+
+	rhall = sys_le16_to_cpu(values[BMM150_RHALL]) >>
+		BMM150_SHIFT_RHALL_L;
+
+	drv_data->sample_x = bmm150_compensate_xy(&drv_data->tregs,
+							raw_x, rhall, true);
+	drv_data->sample_y = bmm150_compensate_xy(&drv_data->tregs,
+							raw_y, rhall, false);
+	drv_data->sample_z = bmm150_compensate_z(&drv_data->tregs,
+							raw_z, rhall);
+
+	return 0;
+}
+
+/*
+ * Datasheet specify raw units are 16 LSB/uT and this function converts it to
+ * Gauss
+ */
+static void bmm150_convert(struct sensor_value *val, int raw_val)
+{
+	/* val = raw_val / 1600 */
+	val->val1 = raw_val / 1600;
+	val->val2 = ((s32_t)raw_val * (1000000 / 1600)) % 1000000;
+}
+
+static int bmm150_channel_get(struct device *dev,
+			      enum sensor_channel chan,
+			      struct sensor_value *val)
+{
+	struct bmm150_data *drv_data = dev->driver_data;
+
+	switch (chan) {
+	case SENSOR_CHAN_MAGN_X:
+		bmm150_convert(val, drv_data->sample_x);
+		break;
+	case SENSOR_CHAN_MAGN_Y:
+		bmm150_convert(val, drv_data->sample_y);
+		break;
+	case SENSOR_CHAN_MAGN_Z:
+		bmm150_convert(val, drv_data->sample_x);
+		break;
+	case SENSOR_CHAN_MAGN_ANY:
+		bmm150_convert(val, drv_data->sample_x);
+		bmm150_convert(val + 1, drv_data->sample_y);
+		bmm150_convert(val + 2, drv_data->sample_z);
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+#if defined(BMM150_SET_ATTR_REP)
+static inline int bmm150_attr_set_rep(struct device *dev,
+				      enum sensor_channel chan,
+				      const struct sensor_value *val)
+{
+	struct bmm150_data *data = dev->driver_data;
+	int max_odr;
+
+	switch (chan) {
+#if defined(CONFIG_BMM150_SAMPLING_REP_XY)
+	case SENSOR_CHAN_MAGN_X:
+	case SENSOR_CHAN_MAGN_Y:
+		if (val->val1 < 1 || val->val1 > 511) {
+			return -EINVAL;
+		}
+
+		if (bmm150_compute_max_odr(dev, val->val1, 0,
+					   &max_odr) < 0) {
+			return -EIO;
+		}
+
+		if (data->odr <= 0) {
+			if (bmm150_read_odr(dev) < 0) {
+				return -EIO;
+			}
+		}
+
+		if (data->odr > max_odr) {
+			return -EINVAL;
+		}
+
+		if (bmm150_write_rep_xy(dev, val->val1) < 0) {
+			return -EIO;
+		}
+		break;
+#endif
+
+#if defined(CONFIG_BMM150_SAMPLING_REP_Z)
+	case SENSOR_CHAN_MAGN_Z:
+		if (val->val1 < 1 || val->val1 > 256) {
+			return -EINVAL;
+		}
+
+		if (bmm150_compute_max_odr(dev, 0, val->val1,
+					   &max_odr) < 0) {
+			return -EIO;
+		}
+
+		if (data->odr <= 0) {
+			if (bmm150_read_odr(dev) < 0) {
+				return -EIO;
+			}
+		}
+
+		if (data->odr > max_odr) {
+			return -EINVAL;
+		}
+
+		if (bmm150_write_rep_z(dev, val->val1) < 0) {
+			return -EIO;
+		}
+		break;
+#endif
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+#endif
+
+#if defined(BMM150_SET_ATTR)
+static int bmm150_attr_set(struct device *dev,
+			   enum sensor_channel chan,
+			   enum sensor_attribute attr,
+			   const struct sensor_value *val)
+{
+	struct bmm150_magn_data *data = dev->driver_data;
+
+	switch (attr) {
+#if defined(CONFIG_BMM150_SAMPLING_RATE_RUNTIME)
+	case SENSOR_ATTR_SAMPLING_FREQUENCY:
+		if (data->max_odr <= 0) {
+			if (bmm150_compute_max_odr(dev, 0, 0,
+						   &data->max_odr) < 0) {
+				return -EIO;
+			}
+		}
+
+		if (data->max_odr < val->val1) {
+			SYS_LOG_ERR("not supported with current oversampling");
+			return -ENOTSUP;
+		}
+
+		if (bmm150_set_odr(dev, (u8_t)(val->val1)) < 0) {
+			return -EIO;
+		}
+		break;
+#endif
+#if defined(BMM150_SET_ATTR_REP)
+	case SENSOR_ATTR_OVERSAMPLING:
+		bmm150_attr_set_rep(dev, chan, val);
+		break;
+#endif
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+#endif
+
+static const struct sensor_driver_api bmm150_api_funcs = {
+#if defined(BMM150_SET_ATTR)
+	.attr_set = bmm150_attr_set,
+#endif
+	.sample_fetch = bmm150_sample_fetch,
+	.channel_get = bmm150_channel_get,
+};
+
+static int bmm150_init_chip(struct device *dev)
+{
+	struct bmm150_data *data = dev->driver_data;
+	const struct bmm150_config *config = dev->config->config_info;
+	u8_t chip_id;
+	struct bmm150_preset preset;
+
+	if (bmm150_set_power_mode(dev, BMM150_POWER_MODE_NORMAL, 0) < 0) {
+		SYS_LOG_ERR("failed to bring up device from normal mode");
+		return -EIO;
+	}
+
+	if (bmm150_set_power_mode(dev, BMM150_POWER_MODE_SUSPEND, 1) < 0) {
+		SYS_LOG_ERR("failed to bring up device in suspend mode");
+		return -EIO;
+	}
+
+	if (bmm150_set_power_mode(dev, BMM150_POWER_MODE_SUSPEND, 0)
+	    < 0) {
+		SYS_LOG_ERR("failed to bring up device from suspend mode");
+		return -EIO;
+	}
+
+	if (i2c_reg_read_byte(data->i2c, config->i2c_slave_addr,
+			      BMM150_REG_CHIP_ID, &chip_id) < 0) {
+		SYS_LOG_ERR("failed reading chip id");
+		goto err_poweroff;
+	}
+
+	if (chip_id != BMM150_CHIP_ID_VAL) {
+		SYS_LOG_ERR("invalid chip id 0x%x", chip_id);
+		goto err_poweroff;
+	}
+
+	preset = bmm150_presets_table[BMM150_DEFAULT_PRESET];
+	if (bmm150_set_odr(dev, preset.odr) < 0) {
+		SYS_LOG_ERR("failed to set ODR to %d",
+			    preset.odr);
+		goto err_poweroff;
+	}
+
+	if (i2c_reg_write_byte(data->i2c, config->i2c_slave_addr,
+			       BMM150_REG_REP_XY,
+			       BMM150_REPXY_TO_REGVAL(preset.rep_xy))
+	    < 0) {
+		SYS_LOG_ERR("failed to set REP XY to %d",
+			    preset.rep_xy);
+		goto err_poweroff;
+	}
+
+	if (i2c_reg_write_byte(data->i2c, config->i2c_slave_addr,
+			       BMM150_REG_REP_Z,
+			       BMM150_REPZ_TO_REGVAL(preset.rep_z)) < 0) {
+		SYS_LOG_ERR("failed to set REP Z to %d",
+			    preset.rep_z);
+		goto err_poweroff;
+	}
+
+	if (bmm150_set_power_mode(dev, BMM150_POWER_MODE_NORMAL, 1)
+	    < 0) {
+		SYS_LOG_ERR("failed to power on device");
+	}
+
+	if (i2c_burst_read(data->i2c, config->i2c_slave_addr,
+			   BMM150_REG_TRIM_START, (u8_t *)&data->tregs,
+			   sizeof(data->tregs)) < 0) {
+		SYS_LOG_ERR("failed to read trim regs");
+		goto err_poweroff;
+	}
+
+	data->rep_xy = 0;
+	data->rep_z = 0;
+	data->odr = 0;
+	data->max_odr = 0;
+	data->sample_x = 0;
+	data->sample_y = 0;
+	data->sample_z = 0;
+
+	data->tregs.xyz1 = sys_le16_to_cpu(data->tregs.xyz1);
+	data->tregs.z1 = sys_le16_to_cpu(data->tregs.z1);
+	data->tregs.z2 = sys_le16_to_cpu(data->tregs.z2);
+	data->tregs.z3 = sys_le16_to_cpu(data->tregs.z3);
+	data->tregs.z4 = sys_le16_to_cpu(data->tregs.z4);
+
+	return 0;
+
+err_poweroff:
+	bmm150_set_power_mode(dev, BMM150_POWER_MODE_NORMAL, 0);
+	bmm150_set_power_mode(dev, BMM150_POWER_MODE_SUSPEND, 1);
+	return -EIO;
+}
+
+static int bmm150_init(struct device *dev)
+{
+	const struct bmm150_config *const config =
+		dev->config->config_info;
+	struct bmm150_data *data = dev->driver_data;
+
+	data->i2c = device_get_binding(config->i2c_master_dev_name);
+	if (!data->i2c) {
+		SYS_LOG_ERR("i2c master not found: %s",
+			    config->i2c_master_dev_name);
+		return -EINVAL;
+	}
+
+	if (bmm150_init_chip(dev) < 0) {
+		SYS_LOG_ERR("failed to initialize chip");
+		return -EIO;
+	}
+
+	return 0;
+}
+
+static const struct bmm150_config bmm150_config = {
+	.i2c_master_dev_name = CONFIG_BMM150_I2C_MASTER_DEV_NAME,
+	.i2c_slave_addr = BMM150_I2C_ADDR,
+};
+
+static struct bmm150_data bmm150_data;
+
+DEVICE_AND_API_INIT(bmm150, CONFIG_BMM150_DEV_NAME, bmm150_init,
+			&bmm150_data, &bmm150_config, POST_KERNEL,
+			CONFIG_SENSOR_INIT_PRIORITY, &bmm150_api_funcs);

drivers/sensor/bmm150/bmm150.h

@@ -0,0 +1,164 @@
+/* sensor_bmm150.h - header file for BMM150 Geomagnetic sensor driver */
+
+/*
+ * Copyright (c) 2017 Intel Corporation
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef _SENSOR_BMM150_H_
+#define _SENSOR_BMM150_H_
+
+
+#include <zephyr/types.h>
+#include <i2c.h>
+#include <stdint.h>
+#include <misc/util.h>
+
+#include <kernel.h>
+#include <device.h>
+#include <sensor.h>
+#include <misc/byteorder.h>
+#include <misc/__assert.h>
+#include <gpio.h>
+
+
+#define BMM150_REG_CHIP_ID         0x40
+#define BMM150_CHIP_ID_VAL         0x32
+
+#define BMM150_REG_X_L             0x42
+#define BMM150_REG_X_M             0x43
+#define BMM150_REG_Y_L             0x44
+#define BMM150_REG_Y_M             0x45
+#define BMM150_SHIFT_XY_L          3
+#define BMM150_REG_Z_L             0x46
+#define BMM150_REG_Z_M             0x47
+#define BMM150_SHIFT_Z_L           1
+#define BMM150_REG_RHALL_L         0x48
+#define BMM150_REG_RHALL_M         0x49
+#define BMM150_SHIFT_RHALL_L       2
+
+#define BMM150_REG_INT_STATUS      0x4A
+
+#define BMM150_REG_POWER           0x4B
+#define BMM150_MASK_POWER_CTL      BIT(0)
+
+#define BMM150_REG_OPMODE_ODR      0x4C
+#define BMM150_MASK_OPMODE         (BIT(2) | BIT(1))
+#define BMM150_SHIFT_OPMODE        1
+#define BMM150_MODE_NORMAL         0x00
+#define BMM150_MODE_FORCED         0x01
+#define BMM150_MODE_SLEEP          0x03
+#define BMM150_MASK_ODR            (BIT(5) | BIT(4) | BIT(3))
+#define BMM150_SHIFT_ODR           3
+
+#define BMM150_REG_LOW_THRESH      0x4F
+#define BMM150_REG_HIGH_THRESH     0x50
+#define BMM150_REG_REP_XY          0x51
+#define BMM150_REG_REP_Z           0x52
+#define BMM150_REG_REP_DATAMASK    0xFF
+
+#define BMM150_REG_TRIM_START      0x5D
+#define BMM150_REG_TRIM_END        0x71
+
+#define BMM150_XY_OVERFLOW_VAL     -4096
+#define BMM150_Z_OVERFLOW_VAL      -16384
+
+#define BMM150_REGVAL_TO_REPXY(regval)     (((regval) * 2) + 1)
+#define BMM150_REGVAL_TO_REPZ(regval)      ((regval) + 1)
+#define BMM150_REPXY_TO_REGVAL(rep)        (((rep) - 1) / 2)
+#define BMM150_REPZ_TO_REGVAL(rep)         ((rep) - 1)
+
+#define BMM150_REG_INT                     0x4D
+
+#define BMM150_REG_INT_DRDY                0x4E
+#define BMM150_MASK_DRDY_EN                BIT(7)
+#define BMM150_SHIFT_DRDY_EN               7
+#define BMM150_DRDY_INT3              BIT(6)
+#define BMM150_MASK_DRDY_Z_EN              BIT(5)
+#define BMM150_MASK_DRDY_Y_EN              BIT(4)
+#define BMM150_MASK_DRDY_X_EN              BIT(3)
+#define BMM150_MASK_DRDY_DR_POLARITY       BIT(2)
+#define BMM150_SHIFT_DRDY_DR_POLARITY      2
+#define BMM150_MASK_DRDY_LATCHING          BIT(1)
+#define BMM150_MASK_DRDY_INT3_POLARITY     BIT(0)
+
+#define BMM150_I2C_ADDR                    CONFIG_BMM150_I2C_ADDR
+
+#if defined(CONFIG_BMM150_SAMPLING_REP_XY) || \
+	defined(CONFIG_BMM150_SAMPLING_REP_Z)
+	#define BMM150_SET_ATTR_REP
+#endif
+
+#if defined(CONFIG_BMM150_MAGN_SAMPLING_RATE_RUNTIME) || \
+	defined(BMM150_MAGN_SET_ATTR_REP)
+	#define BMM150_MAGN_SET_ATTR
+#endif
+
+
+struct bmm150_config {
+	char *i2c_master_dev_name;
+	u16_t i2c_slave_addr;
+};
+
+struct bmm150_trim_regs {
+	s8_t x1;
+	s8_t y1;
+	u16_t reserved1;
+	u8_t reserved2;
+	s16_t z4;
+	s8_t x2;
+	s8_t y2;
+	u16_t reserved3;
+	s16_t z2;
+	u16_t z1;
+	u16_t xyz1;
+	s16_t z3;
+	s8_t xy2;
+	u8_t xy1;
+} __packed;
+
+struct bmm150_data {
+	struct device *i2c;
+	struct k_sem sem;
+	struct bmm150_trim_regs tregs;
+	int rep_xy, rep_z, odr, max_odr;
+	int sample_x, sample_y, sample_z;
+};
+
+enum bmm150_power_modes {
+	BMM150_POWER_MODE_SUSPEND,
+	BMM150_POWER_MODE_SLEEP,
+	BMM150_POWER_MODE_NORMAL
+};
+
+enum bmm150_axis {
+	BMM150_AXIS_X,
+	BMM150_AXIS_Y,
+	BMM150_AXIS_Z,
+	BMM150_RHALL,
+	BMM150_AXIS_XYZ_MAX = BMM150_RHALL,
+	BMM150_AXIS_XYZR_MAX
+};
+
+enum bmm150_presets {
+	BMM150_LOW_POWER_PRESET,
+	BMM150_REGULAR_PRESET,
+	BMM150_ENHANCED_REGULAR_PRESET,
+	BMM150_HIGH_ACCURACY_PRESET
+};
+
+#if defined(CONFIG_BMM150_PRESET_LOW_POWER)
+	#define BMM150_DEFAULT_PRESET BMM150LOW_POWER_PRESET
+#elif defined(CONFIG_BMM150_PRESET_REGULAR)
+	#define BMM150_DEFAULT_PRESET BMM150_REGULAR_PRESET
+#elif defined(CONFIG_BMM150_PRESET_ENHANCED_REGULAR)
+	#define BMM150_DEFAULT_PRESET BMM150_ENHANCED_REGULAR_PRESET
+#elif defined(CONFIG_BMM150_PRESET_HIGH_ACCURACY)
+	#define BMM150_DEFAULT_PRESET BMM150_HIGH_ACCURACY_PRESET
+#endif
+
+#define SYS_LOG_DOMAIN "BMM150"
+#define SYS_LOG_LEVEL CONFIG_SYS_LOG_SENSOR_LEVEL
+#include <logging/sys_log.h>
+#endif /* __SENSOR_BMM150_H__ */

include/bluetooth/hci.h

@@ -1438,6 +1438,15 @@ struct bt_hci_evt_link_key_notify {
 	u8_t      key_type;
 } __packed;
 
+/* Overflow link types */
+#define BT_OVERFLOW_LINK_SYNCH                  0x00
+#define BT_OVERFLOW_LINK_ACL                    0x01
+
+#define BT_HCI_EVT_DATA_BUF_OVERFLOW            0x1a
+struct bt_hci_evt_data_buf_overflow {
+	u8_t      link_type;
+} __packed;
+
 #define BT_HCI_EVT_INQUIRY_RESULT_WITH_RSSI     0x22
 struct bt_hci_evt_inquiry_result_with_rssi {
 	bt_addr_t addr;

include/bluetooth/mesh.h

@@ -292,9 +292,6 @@ extern const struct bt_mesh_model_op bt_mesh_cfg_op[];
 struct bt_mesh_health {
 	struct bt_mesh_model *model;
 
-	/* Health Period (divider) */
-	u8_t period;
-
 	/* Fetch current faults */
 	int (*fault_get_cur)(struct bt_mesh_model *model, u8_t *test_id,
 			     u16_t *company_id, u8_t *faults,

kernel/include/timeout_q.h

@@ -197,7 +197,7 @@ static inline void _add_timeout(struct k_thread *thread,
 				_wait_q_t *wait_q,
 				s32_t timeout_in_ticks)
 {
-	__ASSERT(timeout_in_ticks > 0, "");
+	__ASSERT(timeout_in_ticks >= 0, "");
 
 	timeout->delta_ticks_from_prev = timeout_in_ticks;
 	timeout->thread = thread;
@@ -207,6 +207,16 @@ static inline void _add_timeout(struct k_thread *thread,
 	_dump_timeout(timeout, 0);
 	_dump_timeout_q();
 
+	/* If timer is submitted to expire ASAP with
+	 * timeout_in_ticks (duration) as zero value,
+	 * then handle timeout immedately without going
+	 * through timeout queue.
+	 */
+	if (!timeout_in_ticks) {
+		_handle_one_expired_timeout(timeout);
+		return;
+	}
+
 	s32_t *delta = &timeout->delta_ticks_from_prev;
 	struct _timeout *in_q;
 

kernel/poll.c

@@ -292,7 +292,8 @@ static int _signal_poll_event(struct k_poll_event *event, u32_t state,
 
 	_unpend_thread(thread);
 	_abort_thread_timeout(thread);
-	_set_thread_return_value(thread, 0);
+	_set_thread_return_value(thread,
+				 state == K_POLL_STATE_NOT_READY ? -EINTR : 0);
 
 	if (!_is_thread_ready(thread)) {
 		goto ready_event;

kernel/queue.c

@@ -68,11 +68,9 @@ static void prepare_thread_to_run(struct k_thread *thread, void *data)
 #endif /* CONFIG_POLL */
 
 /* returns 1 if a reschedule must take place, 0 otherwise */
-static inline int handle_poll_events(struct k_queue *queue)
+static inline int handle_poll_events(struct k_queue *queue, u32_t state)
 {
 #ifdef CONFIG_POLL
-	u32_t state = K_POLL_STATE_DATA_AVAILABLE;
-
 	return _handle_obj_poll_events(&queue->poll_events, state);
 #else
 	return 0;
@@ -95,7 +93,7 @@ void k_queue_cancel_wait(struct k_queue *queue)
 		}
 	}
 #else
-	if (handle_poll_events(queue)) {
+	if (handle_poll_events(queue, K_POLL_STATE_NOT_READY)) {
 		(void)_Swap(key);
 		return;
 	}
@@ -126,7 +124,7 @@ void k_queue_insert(struct k_queue *queue, void *prev, void *data)
 	sys_slist_insert(&queue->data_q, prev, data);
 
 #if defined(CONFIG_POLL)
-	if (handle_poll_events(queue)) {
+	if (handle_poll_events(queue, K_POLL_STATE_DATA_AVAILABLE)) {
 		(void)_Swap(key);
 		return;
 	}
@@ -171,7 +169,7 @@ void k_queue_append_list(struct k_queue *queue, void *head, void *tail)
 	}
 #else
 	sys_slist_append_list(&queue->data_q, head, tail);
-	if (handle_poll_events(queue)) {
+	if (handle_poll_events(queue, K_POLL_STATE_DATA_AVAILABLE)) {
 		(void)_Swap(key);
 		return;
 	}
@@ -199,20 +197,32 @@ static void *k_queue_poll(struct k_queue *queue, s32_t timeout)
 {
 	struct k_poll_event event;
 	int err;
+	unsigned int key;
+	void *val;
 
 	k_poll_event_init(&event, K_POLL_TYPE_FIFO_DATA_AVAILABLE,
 			  K_POLL_MODE_NOTIFY_ONLY, queue);
 
-	event.state = K_POLL_STATE_NOT_READY;
+	do {
+		event.state = K_POLL_STATE_NOT_READY;
 
-	err = k_poll(&event, 1, timeout);
-	if (err) {
-		return NULL;
-	}
+		err = k_poll(&event, 1, timeout);
+		if (err) {
+			return NULL;
+		}
 
-	__ASSERT_NO_MSG(event.state == K_POLL_STATE_FIFO_DATA_AVAILABLE);
+		__ASSERT_NO_MSG(event.state ==
+				K_POLL_STATE_FIFO_DATA_AVAILABLE);
 
-	return sys_slist_get(&queue->data_q);
+		/* sys_slist_* aren't threadsafe, so must be always protected by
+		 * irq_lock.
+		 */
+		key = irq_lock();
+		val = sys_slist_get(&queue->data_q);
+		irq_unlock(key);
+	} while (!val && timeout == K_FOREVER);
+
+	return val;
 }
 #endif /* CONFIG_POLL */
 

kernel/timer.c

@@ -114,7 +114,7 @@ void k_timer_start(struct k_timer *timer, s32_t duration, s32_t period)
 	volatile s32_t period_in_ticks, duration_in_ticks;
 
 	period_in_ticks = _ms_to_ticks(period);
-	duration_in_ticks = _TICK_ALIGN + _ms_to_ticks(duration);
+	duration_in_ticks = _ms_to_ticks(duration);
 
 	unsigned int key = irq_lock();
 
@@ -123,8 +123,8 @@ void k_timer_start(struct k_timer *timer, s32_t duration, s32_t period)
 	}
 
 	timer->period = period_in_ticks;
-	_add_timeout(NULL, &timer->timeout, &timer->wait_q, duration_in_ticks);
 	timer->status = 0;
+	_add_timeout(NULL, &timer->timeout, &timer->wait_q, duration_in_ticks);
 	irq_unlock(key);
 }
 

lib/json/json.c

@@ -9,10 +9,11 @@
 #include <errno.h>
 #include <limits.h>
 #include <misc/printk.h>
+#include <misc/util.h>
 #include <stdbool.h>
-#include <zephyr/types.h>
 #include <stdlib.h>
 #include <string.h>
+#include <zephyr/types.h>
 
 #include "json.h"
 
@@ -441,12 +442,12 @@ static int decode_value(struct json_obj *obj,
 
 	switch (descr->type) {
 	case JSON_TOK_OBJECT_START:
-		return obj_parse(obj, descr->sub_descr,
-				 descr->sub_descr_len,
+		return obj_parse(obj, descr->object.sub_descr,
+				 descr->object.sub_descr_len,
 				 field);
 	case JSON_TOK_LIST_START:
-		return arr_parse(obj, descr->element_descr,
-				 descr->n_elements, field, val);
+		return arr_parse(obj, descr->array.element_descr,
+				 descr->array.n_elements, field, val);
 	case JSON_TOK_FALSE:
 	case JSON_TOK_TRUE: {
 		bool *v = field;
@@ -475,6 +476,8 @@ static int decode_value(struct json_obj *obj,
 
 static ptrdiff_t get_elem_size(const struct json_obj_descr *descr)
 {
+	assert(descr->alignment);
+
 	switch (descr->type) {
 	case JSON_TOK_NUMBER:
 		return sizeof(s32_t);
@@ -484,13 +487,15 @@ static ptrdiff_t get_elem_size(const struct json_obj_descr *descr)
 	case JSON_TOK_FALSE:
 		return sizeof(bool);
 	case JSON_TOK_LIST_START:
-		return descr->n_elements * get_elem_size(descr->element_descr);
+		return descr->array.n_elements * get_elem_size(descr->array.element_descr);
 	case JSON_TOK_OBJECT_START: {
 		ptrdiff_t total = 0;
 		size_t i;
 
-		for (i = 0; i < descr->sub_descr_len; i++) {
-			total += get_elem_size(&descr->sub_descr[i]);
+		for (i = 0; i < descr->object.sub_descr_len; i++) {
+			ptrdiff_t s = get_elem_size(&descr->object.sub_descr[i]);
+
+			total += ROUND_UP(s, descr->alignment);
 		}
 
 		return total;
@@ -797,10 +802,6 @@ static int bool_encode(const bool *value, json_append_bytes_t append_bytes,
 	return append_bytes("false", 5, data);
 }
 
-static int obj_encode(const struct json_obj_descr *descr, size_t descr_len,
-		      const void *val, json_append_bytes_t append_bytes,
-		      void *data);
-
 static int encode(const struct json_obj_descr *descr, const void *val,
 		  json_append_bytes_t append_bytes, void *data)
 {
@@ -813,11 +814,12 @@ static int encode(const struct json_obj_descr *descr, const void *val,
 	case JSON_TOK_STRING:
 		return str_encode(ptr, append_bytes, data);
 	case JSON_TOK_LIST_START:
-		return arr_encode(descr->element_descr, ptr,
+		return arr_encode(descr->array.element_descr, ptr,
 				  val, append_bytes, data);
 	case JSON_TOK_OBJECT_START:
-		return obj_encode(descr->sub_descr, descr->sub_descr_len,
-				  ptr, append_bytes, data);
+		return json_obj_encode(descr->object.sub_descr,
+				       descr->object.sub_descr_len,
+				       ptr, append_bytes, data);
 	case JSON_TOK_NUMBER:
 		return num_encode(ptr, append_bytes, data);
 	default:
@@ -825,9 +827,9 @@ static int encode(const struct json_obj_descr *descr, const void *val,
 	}
 }
 
-static int obj_encode(const struct json_obj_descr *descr, size_t descr_len,
-		      const void *val, json_append_bytes_t append_bytes,
-		      void *data)
+int json_obj_encode(const struct json_obj_descr *descr, size_t descr_len,
+		    const void *val, json_append_bytes_t append_bytes,
+		    void *data)
 {
 	size_t i;
 	int ret;
@@ -865,20 +867,6 @@ static int obj_encode(const struct json_obj_descr *descr, size_t descr_len,
 	return append_bytes("}", 1, data);
 }
 
-int json_obj_encode(const struct json_obj_descr *descr, size_t descr_len,
-		    const void *val, json_append_bytes_t append_bytes,
-		    void *data)
-{
-	int ret;
-
-	ret = obj_encode(descr, descr_len, val, append_bytes, data);
-	if (ret < 0) {
-		return ret;
-	}
-
-	return append_bytes("", 1, data);
-}
-
 struct appender {
 	char *buffer;
 	size_t used;
@@ -915,6 +903,8 @@ static int measure_bytes(const char *bytes, size_t len, void *data)
 
 	*total += (ssize_t)len;
 
+	ARG_UNUSED(bytes);
+
 	return 0;
 }
 

lib/json/json.h

@@ -33,6 +33,7 @@ struct json_obj_descr {
 	const char *field_name;
 	size_t field_name_len;
 	size_t offset;
+	size_t alignment;
 
 	/* Valid values here: JSON_TOK_STRING, JSON_TOK_NUMBER,
 	 * JSON_TOK_TRUE, JSON_TOK_FALSE, JSON_TOK_OBJECT_START,
@@ -44,11 +45,11 @@ struct json_obj_descr {
 		struct {
 			const struct json_obj_descr *sub_descr;
 			size_t sub_descr_len;
-		};
+		} object;
 		struct {
 			const struct json_obj_descr *element_descr;
 			size_t n_elements;
-		};
+		} array;
 	};
 };
 
@@ -95,6 +96,7 @@ typedef int (*json_append_bytes_t)(const char *bytes, size_t len,
 		.field_name = (#field_name_), \
 		.field_name_len = sizeof(#field_name_) - 1, \
 		.offset = offsetof(struct_, field_name_), \
+		.alignment = __alignof__(struct_), \
 		.type = type_, \
 	}
 
@@ -128,9 +130,12 @@ typedef int (*json_append_bytes_t)(const char *bytes, size_t len,
 		.field_name = (#field_name_), \
 		.field_name_len = (sizeof(#field_name_) - 1), \
 		.offset = offsetof(struct_, field_name_), \
+		.alignment = __alignof__(struct_), \
 		.type = JSON_TOK_OBJECT_START, \
-		.sub_descr = sub_descr_, \
-		.sub_descr_len = ARRAY_SIZE(sub_descr_) \
+		.object = { \
+			.sub_descr = sub_descr_, \
+			.sub_descr_len = ARRAY_SIZE(sub_descr_), \
+		}, \
 	}
 
 /**
@@ -164,12 +169,16 @@ typedef int (*json_append_bytes_t)(const char *bytes, size_t len,
 		.field_name = (#field_name_), \
 		.field_name_len = sizeof(#field_name_) - 1, \
 		.offset = offsetof(struct_, field_name_), \
+		.alignment = __alignof__(struct_), \
 		.type = JSON_TOK_LIST_START, \
-		.element_descr = &(struct json_obj_descr) { \
-			.type = elem_type_, \
-			.offset = offsetof(struct_, len_field_), \
+		.array = { \
+			.element_descr = &(struct json_obj_descr) { \
+				.type = elem_type_, \
+				.offset = offsetof(struct_, len_field_), \
+				.alignment = __alignof__(struct_), \
+			}, \
+			.n_elements = (max_len_), \
 		}, \
-		.n_elements = (max_len_), \
 	}
 
 /**
@@ -217,14 +226,20 @@ typedef int (*json_append_bytes_t)(const char *bytes, size_t len,
 		.field_name = (#field_name_), \
 		.field_name_len = sizeof(#field_name_) - 1, \
 		.offset = offsetof(struct_, field_name_), \
+		.alignment = __alignof__(struct_), \
 		.type = JSON_TOK_LIST_START, \
-		.element_descr = &(struct json_obj_descr) { \
-			.type = JSON_TOK_OBJECT_START, \
-			.sub_descr = elem_descr_, \
-			.sub_descr_len = elem_descr_len_, \
-			.offset = offsetof(struct_, len_field_), \
+		.array = { \
+			.element_descr = &(struct json_obj_descr) { \
+				.type = JSON_TOK_OBJECT_START, \
+				.object = { \
+					.sub_descr = elem_descr_, \
+					.sub_descr_len = elem_descr_len_, \
+				}, \
+				.offset = offsetof(struct_, len_field_), \
+				.alignment = __alignof__(struct_), \
+			}, \
+			.n_elements = (max_len_), \
 		}, \
-		.n_elements = (max_len_), \
 	}
 
 /**
@@ -250,6 +265,7 @@ typedef int (*json_append_bytes_t)(const char *bytes, size_t len,
 		.field_name = (json_field_name_), \
 		.field_name_len = sizeof(json_field_name_) - 1, \
 		.offset = offsetof(struct_, struct_field_name_), \
+		.alignment = __alignof__(struct_), \
 		.type = type_, \
 	}
 
@@ -275,9 +291,12 @@ typedef int (*json_append_bytes_t)(const char *bytes, size_t len,
 		.field_name = (json_field_name_), \
 		.field_name_len = (sizeof(json_field_name_) - 1), \
 		.offset = offsetof(struct_, struct_field_name_), \
+		.alignment = __alignof__(struct_), \
 		.type = JSON_TOK_OBJECT_START, \
-		.sub_descr = sub_descr_, \
-		.sub_descr_len = ARRAY_SIZE(sub_descr_) \
+		.object = { \
+			.sub_descr = sub_descr_, \
+			.sub_descr_len = ARRAY_SIZE(sub_descr_), \
+		}, \
 	}
 
 /**
@@ -308,12 +327,16 @@ typedef int (*json_append_bytes_t)(const char *bytes, size_t len,
 		.field_name = (json_field_name_), \
 		.field_name_len = sizeof(json_field_name_) - 1, \
 		.offset = offsetof(struct_, struct_field_name_), \
+		.alignment = __alignof__(struct_), \
 		.type = JSON_TOK_LIST_START, \
-		.element_descr = &(struct json_obj_descr) { \
-			.type = elem_type_, \
-			.offset = offsetof(struct_, len_field_), \
+		.array = { \
+			.element_descr = &(struct json_obj_descr) { \
+				.type = elem_type_, \
+				.offset = offsetof(struct_, len_field_), \
+				.alignment = __alignof__(struct_), \
+			}, \
+			.n_elements = (max_len_), \
 		}, \
-		.n_elements = (max_len_), \
 	}
 
 /**
@@ -370,12 +393,16 @@ typedef int (*json_append_bytes_t)(const char *bytes, size_t len,
 		.field_name = json_field_name_, \
 		.field_name_len = sizeof(json_field_name_) - 1, \
 		.offset = offsetof(struct_, struct_field_name_), \
+		.alignment = __alignof__(struct_), \
 		.type = JSON_TOK_LIST_START, \
 		.element_descr = &(struct json_obj_descr) { \
 			.type = JSON_TOK_OBJECT_START, \
-			.sub_descr = elem_descr_, \
-			.sub_descr_len = elem_descr_len_, \
+			.object = { \
+				.sub_descr = elem_descr_, \
+				.sub_descr_len = elem_descr_len_, \
+			}, \
 			.offset = offsetof(struct_, len_field_), \
+			.alignment = __alignof__(struct_), \
 		}, \
 		.n_elements = (max_len_), \
 	}

samples/bluetooth/hci_spi/src/main.c

@@ -225,7 +225,12 @@ static void bt_tx_thread(void *p1, void *p2, void *p3)
 		SYS_LOG_DBG("buf %p type %u len %u",
 			    buf, bt_buf_get_type(buf), buf->len);
 
-		bt_send(buf);
+		ret = bt_send(buf);
+		if (ret) {
+			SYS_LOG_ERR("Unable to send (ret %d)", ret);
+			net_buf_unref(buf);
+		}
+
 		STACK_ANALYZE("tx_stack", bt_tx_thread_stack);
 
 		/* Make sure other threads get a chance to run */

samples/bluetooth/hci_uart/sample.yaml

@@ -4,7 +4,7 @@ sample:
 tests:
 -   test_arm:
         build_only: true
-        platform_whitelist: 96b_nitrogen nrf51_pca10028 nrf52_pca10040
+        platform_whitelist: 96b_nitrogen nrf51_pca10028 nrf52_pca10040 bbc_microbit
         tags: uart bluetooth
 -   test_nrf5:
         build_only: true

samples/bluetooth/hci_uart/src/main.c

@@ -232,11 +232,16 @@ static void tx_thread(void *p1, void *p2, void *p3)
 {
 	while (1) {
 		struct net_buf *buf;
+		int err;
 
 		/* Wait until a buffer is available */
 		buf = net_buf_get(&tx_queue, K_FOREVER);
 		/* Pass buffer to the stack */
-		bt_send(buf);
+		err = bt_send(buf);
+		if (err) {
+			SYS_LOG_ERR("Unable to send (err %d)", err);
+			net_buf_unref(buf);
+		}
 
 		/* Give other threads a chance to run if tx_queue keeps getting
 		 * new data all the time.

samples/sensor/bmm150/Makefile

@@ -0,0 +1,5 @@
+BOARD ?= arduino_101_sss
+CONF_FILE = prj.conf
+
+include ${ZEPHYR_BASE}/Makefile.inc
+

samples/sensor/bmm150/README.rst

@@ -0,0 +1,49 @@
+.. _bmm150:
+
+BMM150 GeoMagnetic Sensor
+#########################
+
+Overview
+********
+
+This sample application periodically reads magnetometer (X, Y, Z) data from
+the first available device that implements SENSOR_CHAN_MAGN_* (predefined array
+of device names). This sample checks the sensor in polling mode (without
+interrupt trigger).
+
+Building and Running
+********************
+
+This sample application uses an BMM150 sensor connected to an Arduino 101 board via I2C.
+Sensor has multiple pins so you need to connect according to connection diagram given in
+`bmm150 datasheet`_ at page 41.
+There are two processor cores (x86 and ARC) on the Arduino 101. You will need to
+flash both this sample's code on the ARC core (using the ``arduino101_ss`` board target),
+and stub code on the x86 core (using the ``arduino_101`` board target), as shown below.
+
+.. code-block:: console
+
+        $ cd $ZEPHYR_BASE/samples/sensor/bmm150
+        $ make BOARD=arduino_101_sss flash
+
+        $ cd $ZEPHYR_BASE/tests/booting/stub
+        $ make BOARD=arduino_101 flash
+
+Sample Output
+=============
+To check output of this sample , any serial console program can be used.
+Here I am using picocom program to open output. Check which tty device it is.
+In my case it is ttyUSB0
+
+.. code-block:: console
+
+        $ sudo picocom -D /dev/ttyUSB0
+
+.. code-block:: console
+
+        ( x y z ) = ( -0.390625  0.087500  -0.390625 )
+        ( x y z ) = ( -0.275000  0.115625  -0.275000 )
+        ( x y z ) = ( -0.281250  0.125000  -0.281250 )
+        ( x y z ) = ( -0.287500  0.134375  -0.287500 )
+
+.. _bmm150 datasheet: http://www.mouser.com/ds/2/783/BST-BMM150-DS001-01-786480.pdf

samples/sensor/bmm150/prj.conf

@@ -0,0 +1,10 @@
+CONFIG_STDOUT_CONSOLE=y
+CONFIG_PRINTK=y
+CONFIG_I2C=y
+CONFIG_GPIO=y
+CONFIG_SENSOR=y
+CONFIG_BMM150=y
+CONFIG_ARC_INIT=y
+CONFIG_ARC_GDB_ENABLE=y
+CONFIG_BMM150_SET_ATTR=y
+CONFIG_BMM150_SAMPLING_RATE_RUNTIME=y

samples/sensor/bmm150/sample.yaml

@@ -0,0 +1,8 @@
+sample:
+        description: TBD
+        name: TBD
+tests:
+-       test:
+                build_only: true
+                platform_whitelist: arduino_101
+                tags: samples sensor

samples/sensor/bmm150/src/Makefile

@@ -0,0 +1 @@
+obj-y = main.o

samples/sensor/bmm150/src/main.c

@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2017 Intel Corporation
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <zephyr.h>
+#include <device.h>
+#include <misc/printk.h>
+#include <sensor.h>
+#include <stdio.h>
+
+void do_main(struct device *dev)
+{
+	int ret;
+	struct sensor_value x, y, z;
+
+	while (1) {
+		ret = sensor_sample_fetch(dev);
+		if (ret) {
+			printk("sensor_sample_fetch failed ret %d\n", ret);
+			return;
+		}
+
+		ret = sensor_channel_get(dev, SENSOR_CHAN_MAGN_X, &x);
+		ret = sensor_channel_get(dev, SENSOR_CHAN_MAGN_Y, &y);
+		ret = sensor_channel_get(dev, SENSOR_CHAN_MAGN_Z, &z);
+
+		printf("( x y z ) = ( %f  %f  %f )\n",
+				sensor_value_to_double(&x),
+				sensor_value_to_double(&y),
+				sensor_value_to_double(&z));
+
+		k_sleep(500);
+	}
+}
+
+struct device *sensor_search()
+{
+	static const char *const magn_sensor[] = { "bmm150", NULL };
+	struct device *dev;
+	int i;
+
+	i = 0;
+	while (magn_sensor[i]) {
+		dev = device_get_binding(magn_sensor[i]);
+		if (dev) {
+			printk("device binding\n");
+			return dev;
+		}
+
+		++i;
+	}
+	return NULL;
+}
+
+void main(void)
+{
+	struct device *dev;
+
+	printk("BMM150 Geomagnetic sensor Application\n");
+
+	dev = sensor_search();
+	if (dev) {
+		printk("Found device is %p, name is %s\n",
+				dev, dev->config->name);
+		do_main(dev);
+	} else {
+		printk("There is no available Geomagnetic device.\n");
+	}
+}

scripts/ci/check-compliance.py

@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 import sys
 import subprocess
 import re
@@ -69,7 +69,7 @@ def run_gitlint(tc, commit_range):
 
     if msg != "":
         failure = ET.SubElement(tc, 'failure', type="failure", message="commit message error on range: %s" %commit_range)
-        failure.text = (str(msg))
+        failure.text = (msg.decode('utf8'))
         return 1
 
     return 0
@@ -86,10 +86,10 @@ def run_checkpatch(tc, commit_range):
             stderr=subprocess.STDOUT, shell=True)
 
     except subprocess.CalledProcessError as ex:
-        m = re.search("([1-9][0-9]*) errors,", str(ex.output))
+        m = re.search("([1-9][0-9]*) errors,", ex.output.decode('utf8'))
         if m:
             failure = ET.SubElement(tc, 'failure', type="failure", message="checkpatch issues")
-            failure.text = (str(ex.output))
+            failure.text = (ex.output.decode('utf8'))
             return 1
 
     return 0
@@ -102,7 +102,7 @@ def check_doc(tc, range):
             log = f.read()
             failure = ET.SubElement(tc, 'failure', type="failure",
                         message="documentation issues")
-            failure.text = (str(log))
+            failure.text = (log.decode('utf8'))
         return 1
 
     return 0

scripts/filter-known-issues.py

@@ -185,6 +185,8 @@ def report_warning(data):
         warnings.write(data)
 
 for filename in args.FILENAMEs:
+    if os.stat(filename).st_size == 0:
+       continue  # skip empty log files
     try:
         with open(filename, "r+b") as f:
             logging.info("%s: filtering", filename)

subsys/bluetooth/common/Kconfig

@@ -8,6 +8,13 @@
 
 if BT_HCI
 
+config BT_HCI_VS_EXT
+	bool "Zephyr HCI Vendor-Specific Extensions"
+	default y
+	help
+	  Enable support for the Zephyr HCI Vendor-Specific Extensions in the
+	  Host and/or Controller.
+
 config BT_RPA
 	# Virtual/hidden option
 	bool

subsys/bluetooth/controller/Kconfig

@@ -30,12 +30,16 @@ endchoice
 
 comment "BLE Controller configuration"
 
-config BT_CTLR_HCI_VS_EXT
-	bool "Zephyr HCI Vendor-Specific Extensions"
-	default y
+config BT_CTLR_HCI_VS_BUILD_INFO
+	string "Zephyr HCI VS Build Info string"
+	default ""
+	depends on BT_HCI_VS_EXT
 	help
-	  Enable support for the Zephyr HCI Vendor-Specific Extensions in the
-	  Controller.
+	  User-defined string that will be returned by the Zephyr VS Read Build
+	  Information command after the Zephyr version and build time. When
+	  setting this to a value different from an empty string, a space
+	  character is required at the beginning to separate it from the
+	  already included information.
 
 config BT_CTLR_DUP_FILTER_LEN
 	prompt "Number of addresses in the scan duplicate filter"
@@ -134,6 +138,7 @@ config BT_CTLR_LE_PING
 
 config BT_CTLR_PRIVACY
 	bool "LE Controller-based Privacy"
+	depends on !SOC_SERIES_NRF51X
 	default y
 	select BT_RPA
 	help
@@ -159,7 +164,7 @@ config BT_CTLR_EXT_SCAN_FP
 
 config BT_CTLR_DATA_LENGTH
 	bool "Data Length Update"
-	default y
+	default y if SOC_SERIES_NRF52X
 	help
 	  Enable support for Bluetooth v4.2 LE Data Length Update procedure in
 	  the Controller.
@@ -176,7 +181,7 @@ config BT_CTLR_DATA_LENGTH_MAX
 
 config BT_CTLR_PHY
 	bool "PHY Update"
-	default y
+	default y if SOC_SERIES_NRF52X
 	help
 	  Enable support for Bluetooth 5.0 PHY Update Procedure in the
 	  Controller.
@@ -333,7 +338,7 @@ config BT_CTLR_SCHED_ADVANCED
 config BT_CTLR_RADIO_ENABLE_FAST
 	bool "Use tTXEN/RXEN,FAST ramp-up"
 	depends on SOC_SERIES_NRF52X
-	default y if SOC_NRF52840
+	default y
 	help
 	  Enable use of fast radio ramp-up mode.
 
@@ -385,6 +390,78 @@ config BT_CTLR_SCAN_REQ_RSSI
 
 endmenu
 
+comment "BLE Controller hardware configuration"
+
+menuconfig BT_CTLR_GPIO_PA
+	bool "Power Amplifier GPIO interface"
+	depends on !SOC_SERIES_NRF51X
+	help
+	  Enable GPIO interface to a Power Amplifier. This allows hardware
+	  designs using PA to let the Controller toggle their state based on
+	  radio activity.
+
+if BT_CTLR_GPIO_PA
+
+config BT_CTLR_GPIO_PA_PIN
+	prompt "Power Amplifier GPIO pin number"
+	int
+	help
+	  GPIO Pin number connected to a Power Amplifier.
+
+config BT_CTLR_GPIO_PA_POL_INV
+	bool "Inverted polarity for the PA pin"
+	help
+	  Enable inverted polarity (active low) for the PA pin.
+
+config BT_CTLR_GPIO_PA_OFFSET
+	prompt "Time from PA ON to Tx ready"
+	int
+	default 5
+	range 0 10
+	help
+	  Time before Tx ready to turn on PA.
+
+endif # BT_CTLR_GPIO_PA
+
+menuconfig BT_CTLR_GPIO_LNA
+	bool "Low Noise Amplifier GPIO interface"
+	depends on !SOC_SERIES_NRF51X
+	help
+	  Enable GPIO interface to a Low Noise Amplifier. This allows hardware
+	  designs using LNAs to let the Controller toggle their state based on
+	  radio activity.
+
+if BT_CTLR_GPIO_LNA
+
+config BT_CTLR_GPIO_LNA_PIN
+	prompt "Low Noise Amplifier GPIO pin number"
+	int
+	help
+	  GPIO Pin number connected to a Low Noise Amplifier.
+
+config BT_CTLR_GPIO_LNA_POL_INV
+	bool "Inverted polarity for the LNA pin"
+	help
+	  Enable inverted polarity (active low) for the LNA pin.
+
+config BT_CTLR_GPIO_LNA_OFFSET
+	prompt "Time from LNA ON to Rx ready"
+	int
+	default 5
+	range 0 10
+	help
+	  Time before Rx ready to turn on LNA.
+
+endif # BT_CTLR_GPIO_LNA
+
+config BT_CTLR_PA_LNA_GPIOTE_CHAN
+	# Hidden "nRF5 GPIO PA/LNA GPIOTE Channel"
+	depends on SOC_FAMILY_NRF5 && (BT_CTLR_GPIO_PA || BT_CTLR_GPIO_LNA)
+	int
+	default 3
+	help
+	  Select the nRF5 GPIOTE channel to use for PA/LNA GPIO feature.
+
 comment "BLE Controller debug configuration"
 
 config BT_CTLR_ASSERT_HANDLER
@@ -407,6 +484,7 @@ config BT_CTLR_PROFILE_ISR
 
 config BT_CTLR_DEBUG_PINS
 	bool "Bluetooth Controller Debug Pins"
+	depends on BOARD_NRF51_PCA10028 || BOARD_NRF52_PCA10040 || BOARD_NRF52840_PCA10056
 	help
 	  Turn on debug GPIO toggling for the BLE Controller. This is useful
 	  when debugging with a logic analyzer or profiling certain sections of

subsys/bluetooth/controller/hal/nrf5/Makefile

@@ -1,4 +1,6 @@
 ccflags-y += -I$(srctree)/subsys/bluetooth/controller
 ccflags-y += -I$(srctree)/subsys/bluetooth
 
+ccflags-$(CONFIG_BT_CTLR_FAST_ENC) += -Ofast
+
 obj-y += cntr.o ecb.o radio.o rand.o

subsys/bluetooth/controller/hal/nrf5/debug.h

@@ -8,157 +8,202 @@
 #ifndef _DEBUG_H_
 #define _DEBUG_H_
 
+#ifdef CONFIG_BT_CTLR_DEBUG_PINS
+#if defined(CONFIG_BOARD_NRF52840_PCA10056)
+#define DEBUG_PORT       NRF_P1
+#define DEBUG_PIN0       BIT(1)
+#define DEBUG_PIN1       BIT(2)
+#define DEBUG_PIN2       BIT(3)
+#define DEBUG_PIN3       BIT(4)
+#define DEBUG_PIN4       BIT(5)
+#define DEBUG_PIN5       BIT(6)
+#define DEBUG_PIN6       BIT(7)
+#define DEBUG_PIN7       BIT(8)
+#define DEBUG_PIN8       BIT(10)
+#define DEBUG_PIN9       BIT(11)
+#elif defined(CONFIG_BOARD_NRF52_PCA10040)
+#define DEBUG_PORT       NRF_GPIO
+#define DEBUG_PIN0       BIT(11)
+#define DEBUG_PIN1       BIT(12)
+#define DEBUG_PIN2       BIT(13)
+#define DEBUG_PIN3       BIT(14)
+#define DEBUG_PIN4       BIT(15)
+#define DEBUG_PIN5       BIT(16)
+#define DEBUG_PIN6       BIT(17)
+#define DEBUG_PIN7       BIT(18)
+#define DEBUG_PIN8       BIT(19)
+#define DEBUG_PIN9       BIT(20)
+#elif defined(CONFIG_BOARD_NRF51_PCA10028)
+#define DEBUG_PORT       NRF_GPIO
+#define DEBUG_PIN0       BIT(12)
+#define DEBUG_PIN1       BIT(13)
+#define DEBUG_PIN2       BIT(14)
+#define DEBUG_PIN3       BIT(15)
+#define DEBUG_PIN4       BIT(16)
+#define DEBUG_PIN5       BIT(17)
+#define DEBUG_PIN6       BIT(18)
+#define DEBUG_PIN7       BIT(19)
+#define DEBUG_PIN8       BIT(20)
+#define DEBUG_PIN9       BIT(23)
+#else
+#error BT_CTLR_DEBUG_PINS not supported on this board.
+#endif
+
+#define DEBUG_PIN_MASK   (DEBUG_PIN0 | DEBUG_PIN1 | DEBUG_PIN2 | DEBUG_PIN3 | \
+			  DEBUG_PIN4 | DEBUG_PIN5 | DEBUG_PIN6 | DEBUG_PIN7 | \
+			  DEBUG_PIN8 | DEBUG_PIN9)
+#define DEBUG_CLOSE_MASK (DEBUG_PIN3 | DEBUG_PIN4 | DEBUG_PIN5 | DEBUG_PIN6)
+
 /* below are some interesting macros referenced by controller
  * which can be defined to SoC's GPIO toggle to observe/debug the
  * controller's runtime behavior.
  */
-#ifdef CONFIG_BT_CTLR_DEBUG_PINS
 #define DEBUG_INIT()            do { \
-				NRF_GPIO->DIRSET = 0x03FF0000; \
-				NRF_GPIO->OUTCLR = 0x03FF0000; } \
+				DEBUG_PORT->DIRSET = DEBUG_PIN_MASK; \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN_MASK; } \
 				while (0)
 
 #define DEBUG_CPU_SLEEP(flag)   do { \
 				if (flag) { \
-				NRF_GPIO->OUTSET = BIT(16); \
-				NRF_GPIO->OUTCLR = BIT(16); } \
+				DEBUG_PORT->OUTSET = DEBUG_PIN0; \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN0; } \
 				else { \
-				NRF_GPIO->OUTCLR = BIT(16); \
-				NRF_GPIO->OUTSET = BIT(16); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN0; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN0; } \
 				} while (0)
 
 #define DEBUG_TICKER_ISR(flag)   do { \
 				if (flag) { \
-				NRF_GPIO->OUTCLR = BIT(17); \
-				NRF_GPIO->OUTSET = BIT(17); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN1; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN1; } \
 				else { \
-				NRF_GPIO->OUTSET = BIT(17); \
-				NRF_GPIO->OUTCLR = BIT(17); } \
+				DEBUG_PORT->OUTSET = DEBUG_PIN1; \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN1; } \
 				} while (0)
 
 #define DEBUG_TICKER_TASK(flag)  do { \
 				if (flag) { \
-				NRF_GPIO->OUTCLR = BIT(17); \
-				NRF_GPIO->OUTSET = BIT(17); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN1; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN1; } \
 				else { \
-				NRF_GPIO->OUTSET = BIT(17); \
-				NRF_GPIO->OUTCLR = BIT(17); } \
+				DEBUG_PORT->OUTSET = DEBUG_PIN1; \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN1; } \
 				} while (0)
 
 #define DEBUG_TICKER_JOB(flag)   do { \
 				if (flag) { \
-				NRF_GPIO->OUTCLR = BIT(18); \
-				NRF_GPIO->OUTSET = BIT(18); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN2; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN2; } \
 				else { \
-				NRF_GPIO->OUTSET = BIT(18); \
-				NRF_GPIO->OUTCLR = BIT(18); } \
+				DEBUG_PORT->OUTSET = DEBUG_PIN2; \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN2; } \
 				} while (0)
 
 #define DEBUG_RADIO_ISR(flag)   do { \
 				if (flag) { \
-				NRF_GPIO->OUTCLR = BIT(23); \
-				NRF_GPIO->OUTSET = BIT(23); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN7; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN7; } \
 				else { \
-				NRF_GPIO->OUTSET = BIT(23); \
-				NRF_GPIO->OUTCLR = BIT(23); } \
+				DEBUG_PORT->OUTSET = DEBUG_PIN7; \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN7; } \
 				} while (0)
 
 #define DEBUG_RADIO_XTAL(flag)  do { \
 				if (flag) { \
-				NRF_GPIO->OUTCLR = BIT(24); \
-				NRF_GPIO->OUTSET = BIT(24); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN8; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN8; } \
 				else { \
-				NRF_GPIO->OUTSET = BIT(24); \
-				NRF_GPIO->OUTCLR = BIT(24); } \
+				DEBUG_PORT->OUTSET = DEBUG_PIN8; \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN8; } \
 				} while (0)
 
 #define DEBUG_RADIO_ACTIVE(flag)    do { \
 				if (flag) { \
-				NRF_GPIO->OUTCLR = BIT(25); \
-				NRF_GPIO->OUTSET = BIT(25); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN9; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN9; } \
 				else { \
-				NRF_GPIO->OUTSET = BIT(25); \
-				NRF_GPIO->OUTCLR = BIT(25); } \
+				DEBUG_PORT->OUTSET = DEBUG_PIN9; \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN9; } \
 				} while (0)
 
 #define DEBUG_RADIO_CLOSE(flag)     do { \
 				if (flag) { \
-				NRF_GPIO->OUTCLR = 0x00000000; \
-				NRF_GPIO->OUTSET = 0x00000000; } \
+				DEBUG_PORT->OUTCLR = 0x00000000; \
+				DEBUG_PORT->OUTSET = 0x00000000; } \
 				else { \
-				NRF_GPIO->OUTCLR = 0x00780000; } \
+				DEBUG_PORT->OUTCLR = DEBUG_CLOSE_MASK; } \
 				} while (0)
 
 #define DEBUG_RADIO_PREPARE_A(flag) do { \
 				if (flag) { \
-				NRF_GPIO->OUTCLR = BIT(19); \
-				NRF_GPIO->OUTSET = BIT(19); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN3; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN3; } \
 				else { \
-				NRF_GPIO->OUTCLR = BIT(19); \
-				NRF_GPIO->OUTSET = BIT(19); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN3; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN3; } \
 				} while (0)
 
 #define DEBUG_RADIO_START_A(flag)   do { \
 				if (flag) { \
-				NRF_GPIO->OUTCLR = BIT(19); \
-				NRF_GPIO->OUTSET = BIT(19); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN3; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN3; } \
 				else { \
-				NRF_GPIO->OUTCLR = BIT(19); \
-				NRF_GPIO->OUTSET = BIT(19); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN3; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN3; } \
 				} while (0)
 
 #define DEBUG_RADIO_PREPARE_S(flag) do { \
 				if (flag) { \
-				NRF_GPIO->OUTCLR = BIT(20); \
-				NRF_GPIO->OUTSET = BIT(20); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN4; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN4; } \
 				else { \
-				NRF_GPIO->OUTCLR = BIT(20); \
-				NRF_GPIO->OUTSET = BIT(20); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN4; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN4; } \
 				} while (0)
 
 #define DEBUG_RADIO_START_S(flag)   do { \
 				if (flag) { \
-				NRF_GPIO->OUTCLR = BIT(20); \
-				NRF_GPIO->OUTSET = BIT(20); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN4; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN4; } \
 				else { \
-				NRF_GPIO->OUTCLR = BIT(20); \
-				NRF_GPIO->OUTSET = BIT(20); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN4; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN4; } \
 				} while (0)
 
 #define DEBUG_RADIO_PREPARE_O(flag) do { \
 				if (flag) { \
-				NRF_GPIO->OUTCLR = BIT(21); \
-				NRF_GPIO->OUTSET = BIT(21); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN5; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN5; } \
 				else { \
-				NRF_GPIO->OUTCLR = BIT(21); \
-				NRF_GPIO->OUTSET = BIT(21); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN5; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN5; } \
 				} while (0)
 
 #define DEBUG_RADIO_START_O(flag)   do { \
 				if (flag) { \
-				NRF_GPIO->OUTCLR = BIT(21); \
-				NRF_GPIO->OUTSET = BIT(21); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN5; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN5; } \
 				else { \
-				NRF_GPIO->OUTCLR = BIT(21); \
-				NRF_GPIO->OUTSET = BIT(21); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN5; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN5; } \
 				} while (0)
 
 #define DEBUG_RADIO_PREPARE_M(flag) do { \
 				if (flag) { \
-				NRF_GPIO->OUTCLR = BIT(22); \
-				NRF_GPIO->OUTSET = BIT(22); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN6; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN6; } \
 				else { \
-				NRF_GPIO->OUTCLR = BIT(22); \
-				NRF_GPIO->OUTSET = BIT(22); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN6; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN6; } \
 				} while (0)
 
 #define DEBUG_RADIO_START_M(flag)   do { \
 				if (flag) { \
-				NRF_GPIO->OUTCLR = BIT(22); \
-				NRF_GPIO->OUTSET = BIT(22); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN6; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN6; } \
 				else { \
-				NRF_GPIO->OUTCLR = BIT(22); \
-				NRF_GPIO->OUTSET = BIT(22); } \
+				DEBUG_PORT->OUTCLR = DEBUG_PIN6; \
+				DEBUG_PORT->OUTSET = DEBUG_PIN6; } \
 				} while (0)
 
 #else

subsys/bluetooth/controller/hal/nrf5/radio.c

@@ -48,6 +48,63 @@ void radio_isr_set(radio_isr_fp fp_radio_isr)
 	irq_enable(RADIO_IRQn);
 }
 
+void radio_setup(void)
+{
+#if defined(CONFIG_BT_CTLR_GPIO_PA_PIN)
+	NRF_GPIO->DIRSET = BIT(CONFIG_BT_CTLR_GPIO_PA_PIN);
+#if defined(CONFIG_BT_CTLR_GPIO_PA_POL_INV)
+	NRF_GPIO->OUTSET = BIT(CONFIG_BT_CTLR_GPIO_PA_PIN);
+#else
+	NRF_GPIO->OUTCLR = BIT(CONFIG_BT_CTLR_GPIO_PA_PIN);
+#endif
+#endif /* CONFIG_BT_CTLR_GPIO_PA_PIN */
+
+#if defined(CONFIG_BT_CTLR_GPIO_LNA_PIN)
+	NRF_GPIO->DIRSET = BIT(CONFIG_BT_CTLR_GPIO_LNA_PIN);
+
+	radio_gpio_lna_off();
+#endif /* CONFIG_BT_CTLR_GPIO_LNA_PIN */
+
+#if defined(CONFIG_SOC_SERIES_NRF52X)
+	struct {
+		u32_t volatile reserved_0[0x5a0 >> 2];
+		u32_t volatile bridge_type;
+		u32_t volatile reserved_1[((0xe00 - 0x5a0) >> 2) - 1];
+		struct {
+			u32_t volatile CPU0;
+			u32_t volatile SPIS1;
+			u32_t volatile RADIO;
+			u32_t volatile ECB;
+			u32_t volatile CCM;
+			u32_t volatile AAR;
+			u32_t volatile SAADC;
+			u32_t volatile UARTE;
+			u32_t volatile SERIAL0;
+			u32_t volatile SERIAL2;
+			u32_t volatile NFCT;
+			u32_t volatile I2S;
+			u32_t volatile PDM;
+			u32_t volatile PWM;
+		} RAMPRI;
+	} volatile *NRF_AMLI = (void volatile *)0x40000000UL;
+
+	NRF_AMLI->RAMPRI.CPU0    = 0xFFFFFFFFUL;
+	NRF_AMLI->RAMPRI.SPIS1   = 0xFFFFFFFFUL;
+	NRF_AMLI->RAMPRI.RADIO   = 0x00000000UL;
+	NRF_AMLI->RAMPRI.ECB     = 0xFFFFFFFFUL;
+	NRF_AMLI->RAMPRI.CCM     = 0x00000000UL;
+	NRF_AMLI->RAMPRI.AAR     = 0xFFFFFFFFUL;
+	NRF_AMLI->RAMPRI.SAADC   = 0xFFFFFFFFUL;
+	NRF_AMLI->RAMPRI.UARTE   = 0xFFFFFFFFUL;
+	NRF_AMLI->RAMPRI.SERIAL0 = 0xFFFFFFFFUL;
+	NRF_AMLI->RAMPRI.SERIAL2 = 0xFFFFFFFFUL;
+	NRF_AMLI->RAMPRI.NFCT    = 0xFFFFFFFFUL;
+	NRF_AMLI->RAMPRI.I2S     = 0xFFFFFFFFUL;
+	NRF_AMLI->RAMPRI.PDM     = 0xFFFFFFFFUL;
+	NRF_AMLI->RAMPRI.PWM     = 0xFFFFFFFFUL;
+#endif /* CONFIG_SOC_SERIES_NRF52X */
+}
+
 void radio_reset(void)
 {
 	irq_disable(RADIO_IRQn);
@@ -78,11 +135,6 @@ void radio_phy_set(u8_t phy, u8_t flags)
 #if defined(CONFIG_SOC_SERIES_NRF51X)
 	case BIT(1):
 		mode = RADIO_MODE_MODE_Nrf_2Mbit;
-
-#if defined(CONFIG_SOC_NRF52840)
-		/* Workaround: nRF52840 Engineering A Errata ID 164 */
-		*(volatile u32_t *)0x4000173c &= ~0x80000000;
-#endif /* CONFIG_SOC_NRF52840 */
 		break;
 
 #elif defined(CONFIG_SOC_SERIES_NRF52X)
@@ -377,7 +429,7 @@ void radio_tx_enable(void)
 void radio_disable(void)
 {
 #if !defined(CONFIG_BT_CTLR_TIFS_HW)
-	NRF_PPI->CHENCLR = PPI_CHEN_CH8_Msk | PPI_CHEN_CH11_Msk;
+	NRF_PPI->CHENCLR = PPI_CHEN_CH9_Msk | PPI_CHEN_CH12_Msk;
 	NRF_PPI->TASKS_CHG[0].DIS = 1;
 	NRF_PPI->TASKS_CHG[1].DIS = 1;
 #endif /* !CONFIG_BT_CTLR_TIFS_HW */
@@ -452,19 +504,19 @@ static u8_t sw_tifs_toggle;
 static void sw_switch(u8_t dir, u8_t phy_curr, u8_t flags_curr, u8_t phy_next,
 		      u8_t flags_next)
 {
-	u8_t ppi = 12 + sw_tifs_toggle;
+	u8_t ppi = 13 + sw_tifs_toggle;
 	u32_t delay;
 
 	NRF_TIMER1->EVENTS_COMPARE[sw_tifs_toggle] = 0;
 
-	NRF_PPI->CH[11].EEP = (u32_t)&(NRF_RADIO->EVENTS_END);
-	NRF_PPI->CH[11].TEP = (u32_t)&(NRF_PPI->TASKS_CHG[sw_tifs_toggle].EN);
+	NRF_PPI->CH[12].EEP = (u32_t)&(NRF_RADIO->EVENTS_END);
+	NRF_PPI->CH[12].TEP = (u32_t)&(NRF_PPI->TASKS_CHG[sw_tifs_toggle].EN);
 
 	NRF_PPI->CH[ppi].EEP = (u32_t)
 			       &(NRF_TIMER1->EVENTS_COMPARE[sw_tifs_toggle]);
 	if (dir) {
 		delay = radio_tx_ready_delay_get(phy_next, flags_next) +
-			radio_rx_chain_delay_get(phy_curr, flags_curr);
+			radio_rx_chain_delay_get(phy_curr, 1);
 
 		NRF_PPI->CH[ppi].TEP = (u32_t)&(NRF_RADIO->TASKS_TXEN);
 	} else {
@@ -481,7 +533,7 @@ static void sw_switch(u8_t dir, u8_t phy_curr, u8_t flags_curr, u8_t phy_next,
 		NRF_TIMER1->CC[sw_tifs_toggle] = 1;
 	}
 
-	NRF_PPI->CHENSET = PPI_CHEN_CH8_Msk | PPI_CHEN_CH11_Msk;
+	NRF_PPI->CHENSET = PPI_CHEN_CH9_Msk | PPI_CHEN_CH12_Msk;
 
 	sw_tifs_toggle += 1;
 	sw_tifs_toggle &= 1;
@@ -521,7 +573,7 @@ void radio_switch_complete_and_disable(void)
 	    (RADIO_SHORTS_READY_START_Msk | RADIO_SHORTS_END_DISABLE_Msk);
 
 #if !defined(CONFIG_BT_CTLR_TIFS_HW)
-	NRF_PPI->CHENCLR = PPI_CHEN_CH8_Msk | PPI_CHEN_CH11_Msk;
+	NRF_PPI->CHENCLR = PPI_CHEN_CH9_Msk | PPI_CHEN_CH12_Msk;
 #endif /* !CONFIG_BT_CTLR_TIFS_HW */
 }
 
@@ -607,7 +659,7 @@ void radio_tmr_status_reset(void)
 	NRF_PPI->CHENCLR =
 	    (PPI_CHEN_CH0_Msk | PPI_CHEN_CH1_Msk | PPI_CHEN_CH2_Msk |
 	     PPI_CHEN_CH3_Msk | PPI_CHEN_CH4_Msk | PPI_CHEN_CH5_Msk |
-	     PPI_CHEN_CH6_Msk | PPI_CHEN_CH7_Msk);
+	     PPI_CHEN_CH6_Msk | PPI_CHEN_CH15_Msk);
 }
 
 void radio_tmr_tifs_set(u32_t tifs)
@@ -643,19 +695,10 @@ u32_t radio_tmr_start(u8_t trx, u32_t ticks_start, u32_t remainder)
 	NRF_PPI->CH[1].TEP = (u32_t)&(NRF_TIMER0->TASKS_START);
 	NRF_PPI->CHENSET = PPI_CHEN_CH1_Msk;
 
-	if (trx) {
-		NRF_PPI->CH[0].EEP =
-			(u32_t)&(NRF_TIMER0->EVENTS_COMPARE[0]);
-		NRF_PPI->CH[0].TEP =
-			(u32_t)&(NRF_RADIO->TASKS_TXEN);
-		NRF_PPI->CHENSET = PPI_CHEN_CH0_Msk;
-	} else {
-		NRF_PPI->CH[0].EEP =
-			(u32_t)&(NRF_TIMER0->EVENTS_COMPARE[0]);
-		NRF_PPI->CH[0].TEP =
-			(u32_t)&(NRF_RADIO->TASKS_RXEN);
-		NRF_PPI->CHENSET = PPI_CHEN_CH0_Msk;
-	}
+	NRF_PPI->CH[0].EEP = (u32_t)&(NRF_TIMER0->EVENTS_COMPARE[0]);
+	NRF_PPI->CH[0].TEP = (trx) ? (u32_t)&(NRF_RADIO->TASKS_TXEN) :
+				     (u32_t)&(NRF_RADIO->TASKS_RXEN);
+	NRF_PPI->CHENSET = PPI_CHEN_CH0_Msk;
 
 #if !defined(CONFIG_BT_CTLR_TIFS_HW)
 	NRF_TIMER1->TASKS_CLEAR = 1;
@@ -664,19 +707,17 @@ u32_t radio_tmr_start(u8_t trx, u32_t ticks_start, u32_t remainder)
 	NRF_TIMER1->BITMODE = 0; /* 16 bit */
 	NRF_TIMER1->TASKS_START = 1;
 
-	NRF_PPI->CH[8].EEP = (u32_t)&(NRF_RADIO->EVENTS_END);
-	NRF_PPI->CH[8].TEP = (u32_t)&(NRF_TIMER1->TASKS_CLEAR);
+	NRF_PPI->CH[9].EEP = (u32_t)&(NRF_RADIO->EVENTS_END);
+	NRF_PPI->CH[9].TEP = (u32_t)&(NRF_TIMER1->TASKS_CLEAR);
 
-	NRF_PPI->CH[9].EEP = (u32_t)
-			     &(NRF_TIMER1->EVENTS_COMPARE[0]);
-	NRF_PPI->CH[9].TEP = (u32_t)&(NRF_PPI->TASKS_CHG[0].DIS);
+	NRF_PPI->CH[10].EEP = (u32_t)&(NRF_TIMER1->EVENTS_COMPARE[0]);
+	NRF_PPI->CH[10].TEP = (u32_t)&(NRF_PPI->TASKS_CHG[0].DIS);
 
-	NRF_PPI->CH[10].EEP = (u32_t)
-			      &(NRF_TIMER1->EVENTS_COMPARE[1]);
-	NRF_PPI->CH[10].TEP = (u32_t)&(NRF_PPI->TASKS_CHG[1].DIS);
+	NRF_PPI->CH[11].EEP = (u32_t)&(NRF_TIMER1->EVENTS_COMPARE[1]);
+	NRF_PPI->CH[11].TEP = (u32_t)&(NRF_PPI->TASKS_CHG[1].DIS);
 
-	NRF_PPI->CHG[0] = PPI_CHG_CH9_Msk | PPI_CHG_CH12_Msk;
-	NRF_PPI->CHG[1] = PPI_CHG_CH10_Msk | PPI_CHG_CH13_Msk;
+	NRF_PPI->CHG[0] = PPI_CHG_CH10_Msk | PPI_CHG_CH13_Msk;
+	NRF_PPI->CHG[1] = PPI_CHG_CH11_Msk | PPI_CHG_CH14_Msk;
 #endif /* !CONFIG_BT_CTLR_TIFS_HW */
 
 	return remainder;
@@ -684,21 +725,45 @@ u32_t radio_tmr_start(u8_t trx, u32_t ticks_start, u32_t remainder)
 
 void radio_tmr_start_us(u8_t trx, u32_t us)
 {
-	if (trx) {
-		NRF_PPI->CH[0].EEP =
-			(u32_t)&(NRF_TIMER0->EVENTS_COMPARE[0]);
-		NRF_PPI->CH[0].TEP =
-			(u32_t)&(NRF_RADIO->TASKS_TXEN);
-	} else {
-		NRF_PPI->CH[0].EEP =
-			(u32_t)&(NRF_TIMER0->EVENTS_COMPARE[0]);
-		NRF_PPI->CH[0].TEP =
-			(u32_t)&(NRF_RADIO->TASKS_RXEN);
-	}
-	NRF_PPI->CHENSET = PPI_CHEN_CH0_Msk;
-
 	NRF_TIMER0->CC[0] = us;
 	NRF_TIMER0->EVENTS_COMPARE[0] = 0;
+
+	NRF_PPI->CH[0].EEP = (u32_t)&(NRF_TIMER0->EVENTS_COMPARE[0]);
+	NRF_PPI->CH[0].TEP = (trx) ? (u32_t)&(NRF_RADIO->TASKS_TXEN) :
+				     (u32_t)&(NRF_RADIO->TASKS_RXEN);
+	NRF_PPI->CHENSET = PPI_CHEN_CH0_Msk;
+}
+
+u32_t radio_tmr_start_now(u8_t trx)
+{
+	u32_t now, start;
+
+	/* Setup PPI for Radio start */
+	NRF_PPI->CH[0].EEP = (u32_t)&(NRF_TIMER0->EVENTS_COMPARE[0]);
+	NRF_PPI->CH[0].TEP = (trx) ? (u32_t)&(NRF_RADIO->TASKS_TXEN) :
+				     (u32_t)&(NRF_RADIO->TASKS_RXEN);
+	NRF_PPI->CHENSET = PPI_CHEN_CH0_Msk;
+
+	/* Capture the current time */
+	NRF_TIMER0->TASKS_CAPTURE[1] = 1;
+	now = NRF_TIMER0->CC[1];
+	start = now;
+
+	/* Setup PPI while determining the latency in doing so */
+	do {
+		/* Set start to be, now plus the determined latency */
+		start = (now << 1) - start;
+
+		/* Setup compare event with min. 1 us offset */
+		NRF_TIMER0->CC[0] = start + 1;
+		NRF_TIMER0->EVENTS_COMPARE[0] = 0;
+
+		/* Capture the current time */
+		NRF_TIMER0->TASKS_CAPTURE[1] = 1;
+		now = NRF_TIMER0->CC[1];
+	} while (now > start);
+
+	return start;
 }
 
 void radio_tmr_stop(void)
@@ -714,14 +779,14 @@ void radio_tmr_stop(void)
 
 void radio_tmr_hcto_configure(u32_t hcto)
 {
-	NRF_TIMER0->CC[2] = hcto;
-	NRF_TIMER0->EVENTS_COMPARE[2] = 0;
+	NRF_TIMER0->CC[1] = hcto;
+	NRF_TIMER0->EVENTS_COMPARE[1] = 0;
 
-	NRF_PPI->CH[4].EEP = (u32_t)&(NRF_RADIO->EVENTS_ADDRESS);
-	NRF_PPI->CH[4].TEP = (u32_t)&(NRF_TIMER0->TASKS_CAPTURE[2]);
-	NRF_PPI->CH[5].EEP = (u32_t)&(NRF_TIMER0->EVENTS_COMPARE[2]);
-	NRF_PPI->CH[5].TEP = (u32_t)&(NRF_RADIO->TASKS_DISABLE);
-	NRF_PPI->CHENSET = (PPI_CHEN_CH4_Msk | PPI_CHEN_CH5_Msk);
+	NRF_PPI->CH[3].EEP = (u32_t)&(NRF_RADIO->EVENTS_ADDRESS);
+	NRF_PPI->CH[3].TEP = (u32_t)&(NRF_TIMER0->TASKS_CAPTURE[1]);
+	NRF_PPI->CH[4].EEP = (u32_t)&(NRF_TIMER0->EVENTS_COMPARE[1]);
+	NRF_PPI->CH[4].TEP = (u32_t)&(NRF_RADIO->TASKS_DISABLE);
+	NRF_PPI->CHENSET = (PPI_CHEN_CH3_Msk | PPI_CHEN_CH4_Msk);
 }
 
 void radio_tmr_aa_capture(void)
@@ -733,21 +798,34 @@ void radio_tmr_aa_capture(void)
 	NRF_PPI->CHENSET = (PPI_CHEN_CH2_Msk | PPI_CHEN_CH3_Msk);
 }
 
+u32_t radio_tmr_aa_get(void)
+{
+	return NRF_TIMER0->CC[1];
+}
+
+static u32_t radio_tmr_aa;
+
+void radio_tmr_aa_save(u32_t aa)
+{
+	radio_tmr_aa = aa;
+}
+
+u32_t radio_tmr_aa_restore(void)
+{
+	/* NOTE: we dont need to restore for now, but return the saved value. */
+	return radio_tmr_aa;
+}
+
 u32_t radio_tmr_ready_get(void)
 {
 	return NRF_TIMER0->CC[0];
 }
 
-u32_t radio_tmr_aa_get(void)
-{
-	return (NRF_TIMER0->CC[1] - NRF_TIMER0->CC[0]);
-}
-
 void radio_tmr_end_capture(void)
 {
-	NRF_PPI->CH[7].EEP = (u32_t)&(NRF_RADIO->EVENTS_END);
-	NRF_PPI->CH[7].TEP = (u32_t)&(NRF_TIMER0->TASKS_CAPTURE[2]);
-	NRF_PPI->CHENSET = PPI_CHEN_CH7_Msk;
+	NRF_PPI->CH[5].EEP = (u32_t)&(NRF_RADIO->EVENTS_END);
+	NRF_PPI->CH[5].TEP = (u32_t)&(NRF_TIMER0->TASKS_CAPTURE[2]);
+	NRF_PPI->CHENSET = PPI_CHEN_CH5_Msk;
 }
 
 u32_t radio_tmr_end_get(void)
@@ -765,19 +843,137 @@ u32_t radio_tmr_sample_get(void)
 	return NRF_TIMER0->CC[3];
 }
 
+#if defined(CONFIG_BT_CTLR_GPIO_PA_PIN) || \
+    defined(CONFIG_BT_CTLR_GPIO_LNA_PIN)
+#if defined(CONFIG_BT_CTLR_GPIO_PA_PIN)
+void radio_gpio_pa_setup(void)
+{
+	NRF_GPIOTE->CONFIG[CONFIG_BT_CTLR_PA_LNA_GPIOTE_CHAN] =
+		(GPIOTE_CONFIG_MODE_Task <<
+		 GPIOTE_CONFIG_MODE_Pos) |
+		(CONFIG_BT_CTLR_GPIO_PA_PIN <<
+		 GPIOTE_CONFIG_PSEL_Pos) |
+		(GPIOTE_CONFIG_POLARITY_Toggle <<
+		 GPIOTE_CONFIG_POLARITY_Pos) |
+#if defined(CONFIG_BT_CTLR_GPIO_PA_POL_INV)
+		(GPIOTE_CONFIG_OUTINIT_High <<
+		 GPIOTE_CONFIG_OUTINIT_Pos);
+#else
+		(GPIOTE_CONFIG_OUTINIT_Low <<
+		 GPIOTE_CONFIG_OUTINIT_Pos);
+#endif
+}
+#endif /* CONFIG_BT_CTLR_GPIO_PA_PIN */
+
+#if defined(CONFIG_BT_CTLR_GPIO_LNA_PIN)
+void radio_gpio_lna_setup(void)
+{
+	NRF_GPIOTE->CONFIG[CONFIG_BT_CTLR_PA_LNA_GPIOTE_CHAN] =
+		(GPIOTE_CONFIG_MODE_Task <<
+		 GPIOTE_CONFIG_MODE_Pos) |
+		(CONFIG_BT_CTLR_GPIO_LNA_PIN <<
+		 GPIOTE_CONFIG_PSEL_Pos) |
+		(GPIOTE_CONFIG_POLARITY_Toggle <<
+		 GPIOTE_CONFIG_POLARITY_Pos) |
+#if defined(CONFIG_BT_CTLR_GPIO_LNA_POL_INV)
+		(GPIOTE_CONFIG_OUTINIT_High <<
+		 GPIOTE_CONFIG_OUTINIT_Pos);
+#else
+		(GPIOTE_CONFIG_OUTINIT_Low <<
+		 GPIOTE_CONFIG_OUTINIT_Pos);
+#endif
+}
+
+void radio_gpio_lna_on(void)
+{
+#if defined(CONFIG_BT_CTLR_GPIO_LNA_POL_INV)
+	NRF_GPIO->OUTCLR = BIT(CONFIG_BT_CTLR_GPIO_LNA_PIN);
+#else
+	NRF_GPIO->OUTSET = BIT(CONFIG_BT_CTLR_GPIO_LNA_PIN);
+#endif
+}
+
+void radio_gpio_lna_off(void)
+{
+#if defined(CONFIG_BT_CTLR_GPIO_LNA_POL_INV)
+	NRF_GPIO->OUTSET = BIT(CONFIG_BT_CTLR_GPIO_LNA_PIN);
+#else
+	NRF_GPIO->OUTCLR = BIT(CONFIG_BT_CTLR_GPIO_LNA_PIN);
+#endif
+}
+#endif /* CONFIG_BT_CTLR_GPIO_LNA_PIN */
+
+void radio_gpio_pa_lna_enable(u32_t trx_us)
+{
+	NRF_TIMER0->CC[2] = trx_us;
+	NRF_TIMER0->EVENTS_COMPARE[2] = 0;
+
+	NRF_PPI->CH[7].EEP = (u32_t)&(NRF_TIMER0->EVENTS_COMPARE[2]);
+	NRF_PPI->CH[7].TEP = (u32_t)
+		&(NRF_GPIOTE->TASKS_OUT[CONFIG_BT_CTLR_PA_LNA_GPIOTE_CHAN]);
+
+	NRF_PPI->CH[8].EEP = (u32_t)&(NRF_RADIO->EVENTS_DISABLED);
+	NRF_PPI->CH[8].TEP = (u32_t)
+		&(NRF_GPIOTE->TASKS_OUT[CONFIG_BT_CTLR_PA_LNA_GPIOTE_CHAN]);
+
+	NRF_PPI->CHENSET = PPI_CHEN_CH7_Msk | PPI_CHEN_CH8_Msk;
+}
+
+void radio_gpio_pa_lna_disable(void)
+{
+	NRF_PPI->CHENCLR = PPI_CHEN_CH7_Msk | PPI_CHEN_CH8_Msk;
+}
+#endif /* CONFIG_BT_CTLR_GPIO_PA_PIN || CONFIG_BT_CTLR_GPIO_LNA_PIN */
+
 static u8_t MALIGN(4) _ccm_scratch[(RADIO_PDU_LEN_MAX - 4) + 16];
 
-void *radio_ccm_rx_pkt_set(struct ccm *ccm, void *pkt)
+void *radio_ccm_rx_pkt_set(struct ccm *ccm, u8_t phy, void *pkt)
 {
+	u32_t mode;
+
 	NRF_CCM->ENABLE = CCM_ENABLE_ENABLE_Disabled;
 	NRF_CCM->ENABLE = CCM_ENABLE_ENABLE_Enabled;
-	NRF_CCM->MODE =
-#if !defined(CONFIG_SOC_SERIES_NRF51X)
-	    ((CCM_MODE_LENGTH_Extended << CCM_MODE_LENGTH_Pos) &
-	       CCM_MODE_LENGTH_Msk) |
+	mode = (CCM_MODE_MODE_Decryption << CCM_MODE_MODE_Pos) &
+	       CCM_MODE_MODE_Msk;
+#if defined(CONFIG_SOC_SERIES_NRF52X)
+	/* Enable CCM support for 8-bit length field PDUs. */
+	mode |= (CCM_MODE_LENGTH_Extended << CCM_MODE_LENGTH_Pos) &
+		CCM_MODE_LENGTH_Msk;
+
+	/* Select CCM data rate based on current PHY in use. */
+	switch (phy) {
+	default:
+	case BIT(0):
+		mode |= (CCM_MODE_DATARATE_1Mbit <<
+			 CCM_MODE_DATARATE_Pos) &
+			CCM_MODE_DATARATE_Msk;
+		break;
+
+	case BIT(1):
+		mode |= (CCM_MODE_DATARATE_2Mbit <<
+			 CCM_MODE_DATARATE_Pos) &
+			CCM_MODE_DATARATE_Msk;
+		break;
+
+#if defined(CONFIG_SOC_NRF52840)
+	case BIT(2):
+		mode |= (CCM_MODE_DATARATE_125Kbps <<
+			 CCM_MODE_DATARATE_Pos) &
+			CCM_MODE_DATARATE_Msk;
+
+		NRF_CCM->RATEOVERRIDE =
+			(CCM_RATEOVERRIDE_RATEOVERRIDE_500Kbps <<
+			 CCM_RATEOVERRIDE_RATEOVERRIDE_Pos) &
+			CCM_RATEOVERRIDE_RATEOVERRIDE_Msk;
+
+		NRF_PPI->CH[15].EEP = (u32_t)&(NRF_RADIO->EVENTS_RATEBOOST);
+		NRF_PPI->CH[15].TEP = (u32_t)&(NRF_CCM->TASKS_RATEOVERRIDE);
+		NRF_PPI->CHENSET = PPI_CHEN_CH15_Msk;
+		break;
+#endif /* CONFIG_SOC_NRF52840 */
+	}
 #endif
-	    ((CCM_MODE_MODE_Decryption << CCM_MODE_MODE_Pos) &
-	     CCM_MODE_MODE_Msk);
+	NRF_CCM->MODE = mode;
 	NRF_CCM->CNFPTR = (u32_t)ccm;
 	NRF_CCM->INPTR = (u32_t)_pkt_scratch;
 	NRF_CCM->OUTPTR = (u32_t)pkt;
@@ -798,15 +994,24 @@ void *radio_ccm_rx_pkt_set(struct ccm *ccm, void *pkt)
 
 void *radio_ccm_tx_pkt_set(struct ccm *ccm, void *pkt)
 {
+	u32_t mode;
+
 	NRF_CCM->ENABLE = CCM_ENABLE_ENABLE_Disabled;
 	NRF_CCM->ENABLE = CCM_ENABLE_ENABLE_Enabled;
-	NRF_CCM->MODE =
-#if !defined(CONFIG_SOC_SERIES_NRF51X)
-	    ((CCM_MODE_LENGTH_Extended << CCM_MODE_LENGTH_Pos) &
-	       CCM_MODE_LENGTH_Msk) |
+	mode = (CCM_MODE_MODE_Encryption << CCM_MODE_MODE_Pos) &
+	       CCM_MODE_MODE_Msk;
+#if defined(CONFIG_SOC_SERIES_NRF52X)
+	/* Enable CCM support for 8-bit length field PDUs. */
+	mode |= (CCM_MODE_LENGTH_Extended << CCM_MODE_LENGTH_Pos) &
+		CCM_MODE_LENGTH_Msk;
+
+	/* NOTE: use fastest data rate as tx data needs to be prepared before
+	 * radio Tx on any PHY.
+	 */
+	mode |= (CCM_MODE_DATARATE_2Mbit << CCM_MODE_DATARATE_Pos) &
+		CCM_MODE_DATARATE_Msk;
 #endif
-	    ((CCM_MODE_MODE_Encryption << CCM_MODE_MODE_Pos) &
-	     CCM_MODE_MODE_Msk);
+	NRF_CCM->MODE = mode;
 	NRF_CCM->CNFPTR = (u32_t)ccm;
 	NRF_CCM->INPTR = (u32_t)pkt;
 	NRF_CCM->OUTPTR = (u32_t)_pkt_scratch;
@@ -844,13 +1049,19 @@ static u8_t MALIGN(4) _aar_scratch[3];
 
 void radio_ar_configure(u32_t nirk, void *irk)
 {
-	NRF_AAR->ENABLE = 1;
+	NRF_AAR->ENABLE = (AAR_ENABLE_ENABLE_Enabled << AAR_ENABLE_ENABLE_Pos) &
+			  AAR_ENABLE_ENABLE_Msk;
 	NRF_AAR->NIRK = nirk;
 	NRF_AAR->IRKPTR = (u32_t)irk;
 	NRF_AAR->ADDRPTR = (u32_t)NRF_RADIO->PACKETPTR - 1;
 	NRF_AAR->SCRATCHPTR = (u32_t)&_aar_scratch[0];
 
+	NRF_AAR->EVENTS_END = 0;
+	NRF_AAR->EVENTS_RESOLVED = 0;
+	NRF_AAR->EVENTS_NOTRESOLVED = 0;
+
 	radio_bc_configure(64);
+	radio_bc_status_reset();
 
 	NRF_PPI->CH[6].EEP = (u32_t)&(NRF_RADIO->EVENTS_BCMATCH);
 	NRF_PPI->CH[6].TEP = (u32_t)&(NRF_AAR->TASKS_START);
@@ -864,18 +1075,16 @@ u32_t radio_ar_match_get(void)
 
 void radio_ar_status_reset(void)
 {
-	if (radio_bc_has_match()) {
-		NRF_AAR->EVENTS_END = 0;
-		NRF_AAR->EVENTS_RESOLVED = 0;
-		NRF_AAR->EVENTS_NOTRESOLVED = 0;
-	}
-
 	radio_bc_status_reset();
+
+	NRF_AAR->ENABLE = (AAR_ENABLE_ENABLE_Disabled << AAR_ENABLE_ENABLE_Pos) &
+			  AAR_ENABLE_ENABLE_Msk;
 }
 
 u32_t radio_ar_has_match(void)
 {
 	return (radio_bc_has_match() &&
-			(NRF_AAR->EVENTS_END) &&
-			(NRF_AAR->EVENTS_RESOLVED));
+		NRF_AAR->EVENTS_END &&
+		NRF_AAR->EVENTS_RESOLVED &&
+		!NRF_AAR->EVENTS_NOTRESOLVED);
 }

subsys/bluetooth/controller/hal/nrf5/rand.c

@@ -57,32 +57,81 @@ void rand_isr_init(u8_t *context, u8_t context_len, u8_t threshold)
 
 static size_t get(struct rand *rng, size_t octets, u8_t *rand)
 {
-	u8_t first;
-	u8_t avail;
+	u8_t first, last, remaining;
 
 	LL_ASSERT(rng);
 
-	while (octets) {
-		if (rng->first == rng->last) {
-			break;
+	first = rng->first;
+	last = rng->last;
+
+	if (first <= last) {
+		u8_t *d, *s;
+		u8_t avail;
+
+		d = &rand[octets];
+		s = &rng->rand[first];
+
+		avail = last - first;
+		if (octets < avail) {
+			remaining = avail - octets;
+			avail = octets;
+		} else {
+			remaining = 0;
 		}
 
-		rand[--octets] = rng->rand[rng->first];
+		first += avail;
+		octets -= avail;
 
-		first = rng->first + 1;
-		if (first == rng->count) {
+		while (avail--) {
+			*(--d) = *s++;
+		}
+
+		rng->first = first;
+	} else {
+		u8_t *d, *s;
+		u8_t avail;
+
+		d = &rand[octets];
+		s = &rng->rand[first];
+
+		avail = rng->count - first;
+		if (octets < avail) {
+			remaining = avail + last - octets;
+			avail = octets;
+			first += avail;
+		} else {
+			remaining = last;
 			first = 0;
 		}
+
+		octets -= avail;
+
+		while (avail--) {
+			*(--d) = *s++;
+		}
+
+		if (octets && last) {
+			s = &rng->rand[0];
+
+			if (octets < last) {
+				remaining = last - octets;
+				last = octets;
+			} else {
+				remaining = 0;
+			}
+
+			first = last;
+			octets -= last;
+
+			while (last--) {
+				*(--d) = *s++;
+			}
+		}
+
 		rng->first = first;
 	}
 
-	if (rng->first <= rng->last) {
-		avail = rng->last - rng->first;
-	} else {
-		avail = rng->count - rng->first + rng->last;
-	}
-
-	if (avail < rng->threshold) {
+	if (remaining < rng->threshold) {
 		NRF_RNG->TASKS_START = 1;
 	}
 

subsys/bluetooth/controller/hal/radio.h

@@ -13,6 +13,7 @@ typedef void (*radio_isr_fp) (void);
 void isr_radio(void);
 void radio_isr_set(radio_isr_fp fp_radio_isr);
 
+void radio_setup(void);
 void radio_reset(void);
 void radio_phy_set(u8_t phy, u8_t flags);
 void radio_tx_power_set(u32_t power);
@@ -67,17 +68,27 @@ void radio_tmr_status_reset(void);
 void radio_tmr_tifs_set(u32_t tifs);
 u32_t radio_tmr_start(u8_t trx, u32_t ticks_start, u32_t remainder);
 void radio_tmr_start_us(u8_t trx, u32_t us);
+u32_t radio_tmr_start_now(u8_t trx);
 void radio_tmr_stop(void);
 void radio_tmr_hcto_configure(u32_t hcto);
 void radio_tmr_aa_capture(void);
-u32_t radio_tmr_ready_get(void);
 u32_t radio_tmr_aa_get(void);
+void radio_tmr_aa_save(u32_t aa);
+u32_t radio_tmr_aa_restore(void);
+u32_t radio_tmr_ready_get(void);
 void radio_tmr_end_capture(void);
 u32_t radio_tmr_end_get(void);
 void radio_tmr_sample(void);
 u32_t radio_tmr_sample_get(void);
 
-void *radio_ccm_rx_pkt_set(struct ccm *ccm, void *pkt);
+void radio_gpio_pa_setup(void);
+void radio_gpio_lna_setup(void);
+void radio_gpio_lna_on(void);
+void radio_gpio_lna_off(void);
+void radio_gpio_pa_lna_enable(u32_t trx_us);
+void radio_gpio_pa_lna_disable(void);
+
+void *radio_ccm_rx_pkt_set(struct ccm *ccm, u8_t phy, void *pkt);
 void *radio_ccm_tx_pkt_set(struct ccm *ccm, void *pkt);
 u32_t radio_ccm_is_done(void);
 u32_t radio_ccm_mic_is_valid(void);

subsys/bluetooth/controller/hci/hci.c

@@ -18,6 +18,7 @@
 #include <bluetooth/hci_vs.h>
 #include <bluetooth/buf.h>
 #include <bluetooth/bluetooth.h>
+#include <drivers/bluetooth/hci_driver.h>
 #include <misc/byteorder.h>
 #include <misc/util.h>
 
@@ -57,6 +58,7 @@ static u32_t dup_curr;
 s32_t    hci_hbuf_total;
 u32_t    hci_hbuf_sent;
 u32_t    hci_hbuf_acked;
+u16_t    hci_hbuf_pend[CONFIG_BT_MAX_CONN];
 atomic_t hci_state_mask;
 static struct k_poll_signal *hbuf_signal;
 #endif
@@ -73,6 +75,11 @@ static u64_t event_mask = DEFAULT_EVENT_MASK;
 static u64_t event_mask_page_2 = DEFAULT_EVENT_MASK_PAGE_2;
 static u64_t le_event_mask = DEFAULT_LE_EVENT_MASK;
 
+#if defined(CONFIG_BT_CONN)
+static void le_conn_complete(u8_t status, struct radio_le_conn_cmplt *radio_cc,
+			     u16_t handle, struct net_buf *buf);
+#endif /* CONFIG_BT_CONN */
+
 static void evt_create(struct net_buf *buf, u8_t evt, u8_t len)
 {
 	struct bt_hci_evt_hdr *hdr;
@@ -214,6 +221,7 @@ static void reset(struct net_buf *buf, struct net_buf **evt)
 	hci_hbuf_total = 0;
 	hci_hbuf_sent = 0;
 	hci_hbuf_acked = 0;
+	memset(hci_hbuf_pend, 0, sizeof(hci_hbuf_pend));
 	conn_count = 0;
 	if (buf) {
 		atomic_set_bit(&hci_state_mask, HCI_STATE_BIT_RESET);
@@ -261,6 +269,7 @@ static void set_ctl_to_host_flow(struct net_buf *buf, struct net_buf **evt)
 
 	hci_hbuf_sent = 0;
 	hci_hbuf_acked = 0;
+	memset(hci_hbuf_pend, 0, sizeof(hci_hbuf_pend));
 	hci_hbuf_total = -hci_hbuf_total;
 }
 
@@ -310,7 +319,18 @@ static void host_num_completed_packets(struct net_buf *buf,
 
 	/* leave *evt == NULL so no event is generated */
 	for (i = 0; i < cmd->num_handles; i++) {
-		count += sys_le16_to_cpu(cmd->h[i].count);
+		u16_t h = sys_le16_to_cpu(cmd->h[i].handle);
+		u16_t c = sys_le16_to_cpu(cmd->h[i].count);
+
+		if ((h >= ARRAY_SIZE(hci_hbuf_pend)) ||
+		    (c > hci_hbuf_pend[h])) {
+			ccst = cmd_complete(evt, sizeof(*ccst));
+			ccst->status = BT_HCI_ERR_INVALID_PARAM;
+			return;
+		}
+
+		hci_hbuf_pend[h] -= c;
+		count += c;
 	}
 
 	BT_DBG("FC: acked: %d", count);
@@ -456,86 +476,87 @@ static void read_supported_commands(struct net_buf *buf, struct net_buf **evt)
 	rp->commands[5] |= BIT(6) | BIT(7);
 	/* Read TX Power Level. */
 	rp->commands[10] |= BIT(2);
+
 #if defined(CONFIG_BT_HCI_ACL_FLOW_CONTROL)
 	/* Set FC, Host Buffer Size and Host Num Completed */
 	rp->commands[10] |= BIT(5) | BIT(6) | BIT(7);
-#endif
+#endif /* CONFIG_BT_HCI_ACL_FLOW_CONTROL */
+
 	/* Read Local Version Info, Read Local Supported Features. */
 	rp->commands[14] |= BIT(3) | BIT(5);
 	/* Read BD ADDR. */
 	rp->commands[15] |= BIT(1);
+
 #if defined(CONFIG_BT_CTLR_CONN_RSSI)
 	/* Read RSSI. */
 	rp->commands[15] |= BIT(5);
 #endif /* CONFIG_BT_CTLR_CONN_RSSI */
+
 	/* Set Event Mask Page 2 */
 	rp->commands[22] |= BIT(2);
 	/* LE Set Event Mask, LE Read Buffer Size, LE Read Local Supp Feats,
 	 * Set Random Addr
 	 */
 	rp->commands[25] |= BIT(0) | BIT(1) | BIT(2) | BIT(4);
+
+#if defined(CONFIG_BT_CTLR_FILTER)
 	/* LE Read WL Size, LE Clear WL */
 	rp->commands[26] |= BIT(6) | BIT(7);
 	/* LE Add Dev to WL, LE Remove Dev from WL */
 	rp->commands[27] |= BIT(0) | BIT(1);
+#endif /* CONFIG_BT_CTLR_FILTER */
+
 	/* LE Encrypt, LE Rand */
 	rp->commands[27] |= BIT(6) | BIT(7);
 	/* LE Read Supported States */
 	rp->commands[28] |= BIT(3);
+
 #if defined(CONFIG_BT_BROADCASTER)
 	/* LE Set Adv Params, LE Read Adv Channel TX Power, LE Set Adv Data */
 	rp->commands[25] |= BIT(5) | BIT(6) | BIT(7);
 	/* LE Set Scan Response Data, LE Set Adv Enable */
 	rp->commands[26] |= BIT(0) | BIT(1);
-#endif
+#endif /* CONFIG_BT_BROADCASTER */
+
 #if defined(CONFIG_BT_OBSERVER)
 	/* LE Set Scan Params, LE Set Scan Enable */
 	rp->commands[26] |= BIT(2) | BIT(3);
-#endif
+#endif /* CONFIG_BT_OBSERVER */
+
+#if defined(CONFIG_BT_CONN)
 #if defined(CONFIG_BT_CENTRAL)
 	/* LE Create Connection, LE Create Connection Cancel */
 	rp->commands[26] |= BIT(4) | BIT(5);
 	/* Set Host Channel Classification */
 	rp->commands[27] |= BIT(3);
+
 #if defined(CONFIG_BT_CTLR_LE_ENC)
 	/* LE Start Encryption */
 	rp->commands[28] |= BIT(0);
 #endif /* CONFIG_BT_CTLR_LE_ENC */
 #endif /* CONFIG_BT_CENTRAL */
+
 #if defined(CONFIG_BT_PERIPHERAL)
 #if defined(CONFIG_BT_CTLR_LE_ENC)
 	/* LE LTK Request Reply, LE LTK Request Negative Reply */
 	rp->commands[28] |= BIT(1) | BIT(2);
 #endif /* CONFIG_BT_CTLR_LE_ENC */
-#endif
-#if defined(CONFIG_BT_CTLR_DTM_HCI)
-	/* LE RX Test, LE TX Test, LE Test End */
-	rp->commands[28] |= BIT(4) | BIT(5) | BIT(6);
-	/* LE Enhanced RX Test. */
-	rp->commands[35] |= BIT(7);
-	/* LE Enhanced TX Test. */
-	rp->commands[36] |= BIT(0);
-#endif /* CONFIG_BT_CTLR_DTM_HCI */
-#if defined(CONFIG_BT_CONN)
+#endif /* CONFIG_BT_PERIPHERAL */
+
 	/* Disconnect. */
 	rp->commands[0] |= BIT(5);
 	/* LE Connection Update, LE Read Channel Map, LE Read Remote Features */
 	rp->commands[27] |= BIT(2) | BIT(4) | BIT(5);
+
+#if defined(CONFIG_BT_CTLR_CONN_PARAM_REQ)
 	/* LE Remote Conn Param Req and Neg Reply */
 	rp->commands[33] |= BIT(4) | BIT(5);
+#endif /* CONFIG_BT_CTLR_CONN_PARAM_REQ */
+
 #if defined(CONFIG_BT_CTLR_LE_PING)
 	/* Read and Write authenticated payload timeout */
 	rp->commands[32] |= BIT(4) | BIT(5);
-#endif
-#endif /* CONFIG_BT_CONN */
-#if defined(CONFIG_BT_CTLR_PRIVACY)
-	/* LE resolving list commands, LE Read Peer RPA */
-	rp->commands[34] |= BIT(3) | BIT(4) | BIT(5) | BIT(6) | BIT(7);
-	/* LE Read Local RPA, LE Set AR Enable, Set RPA Timeout */
-	rp->commands[35] |= BIT(0) | BIT(1) | BIT(2);
-	/* LE Set Privacy Mode */
-	rp->commands[39] |= BIT(2);
-#endif /* CONFIG_BT_CTLR_PRIVACY */
+#endif /* CONFIG_BT_CTLR_LE_PING */
 
 #if defined(CONFIG_BT_CTLR_DATA_LENGTH)
 	/* LE Set Data Length, and LE Read Suggested Data Length. */
@@ -546,10 +567,39 @@ static void read_supported_commands(struct net_buf *buf, struct net_buf **evt)
 	rp->commands[35] |= BIT(3);
 #endif /* CONFIG_BT_CTLR_DATA_LENGTH */
 
+#if defined(CONFIG_BT_CTLR_PHY)
+	/* LE Read PHY Command. */
+	rp->commands[35] |= BIT(4);
+	/* LE Set Default PHY Command. */
+	rp->commands[35] |= BIT(5);
+	/* LE Set PHY Command. */
+	rp->commands[35] |= BIT(6);
+#endif /* CONFIG_BT_CTLR_PHY */
+#endif /* CONFIG_BT_CONN */
+
+#if defined(CONFIG_BT_CTLR_DTM_HCI)
+	/* LE RX Test, LE TX Test, LE Test End */
+	rp->commands[28] |= BIT(4) | BIT(5) | BIT(6);
+	/* LE Enhanced RX Test. */
+	rp->commands[35] |= BIT(7);
+	/* LE Enhanced TX Test. */
+	rp->commands[36] |= BIT(0);
+#endif /* CONFIG_BT_CTLR_DTM_HCI */
+
+#if defined(CONFIG_BT_CTLR_PRIVACY)
+	/* LE resolving list commands, LE Read Peer RPA */
+	rp->commands[34] |= BIT(3) | BIT(4) | BIT(5) | BIT(6) | BIT(7);
+	/* LE Read Local RPA, LE Set AR Enable, Set RPA Timeout */
+	rp->commands[35] |= BIT(0) | BIT(1) | BIT(2);
+	/* LE Set Privacy Mode */
+	rp->commands[39] |= BIT(2);
+#endif /* CONFIG_BT_CTLR_PRIVACY */
+
 #if defined(CONFIG_BT_HCI_RAW) && defined(CONFIG_BT_TINYCRYPT_ECC)
 	/* LE Read Local P256 Public Key and LE Generate DH Key*/
 	rp->commands[34] |= BIT(1) | BIT(2);
-#endif
+#endif /* CONFIG_BT_HCI_RAW && CONFIG_BT_TINYCRYPT_ECC */
+
 	/* LE Read TX Power. */
 	rp->commands[38] |= BIT(7);
 }
@@ -682,11 +732,12 @@ static void le_set_random_address(struct net_buf *buf, struct net_buf **evt)
 {
 	struct bt_hci_cp_le_set_random_address *cmd = (void *)buf->data;
 	struct bt_hci_evt_cc_status *ccst;
+	u32_t status;
 
-	ll_addr_set(1, &cmd->bdaddr.val[0]);
+	status = ll_addr_set(1, &cmd->bdaddr.val[0]);
 
 	ccst = cmd_complete(evt, sizeof(*ccst));
-	ccst->status = 0x00;
+	ccst->status = status;
 }
 
 static void le_read_wl_size(struct net_buf *buf, struct net_buf **evt)
@@ -958,12 +1009,29 @@ static void le_create_connection(struct net_buf *buf, struct net_buf **evt)
 static void le_create_conn_cancel(struct net_buf *buf, struct net_buf **evt)
 {
 	struct bt_hci_evt_cc_status *ccst;
+	struct net_buf *cc;
+	u8_t cmd_status;
 	u32_t status;
 
 	status = ll_connect_disable();
+	cmd_status = status ? BT_HCI_ERR_CMD_DISALLOWED : 0x00;
+
+	if (!cmd_status) {
+		*evt = bt_buf_get_rx(BT_BUF_EVT, K_FOREVER);
+		le_conn_complete(BT_HCI_ERR_UNKNOWN_CONN_ID, NULL, 0x0000,
+				 *evt);
+		if ((*evt)->len) {
+			ccst = cmd_complete(&cc, sizeof(*ccst));
+			ccst->status = cmd_status;
+			bt_recv_prio(cc);
+			return;
+		} else {
+			net_buf_unref(*evt);
+		}
+	}
 
 	ccst = cmd_complete(evt, sizeof(*ccst));
-	ccst->status = (!status) ? 0x00 : BT_HCI_ERR_CMD_DISALLOWED;
+	ccst->status = cmd_status;
 }
 
 static void le_set_host_chan_classif(struct net_buf *buf, struct net_buf **evt)
@@ -1072,13 +1140,10 @@ static void le_conn_update(struct net_buf *buf, struct net_buf **evt)
 	conn_latency = sys_le16_to_cpu(cmd->conn_latency);
 	supervision_timeout = sys_le16_to_cpu(cmd->supervision_timeout);
 
-	/** @todo if peer supports LE Conn Param Req,
-	* use Req cmd (1) instead of Initiate cmd (0).
-	*/
 	status = ll_conn_update(handle, 0, 0, conn_interval_max,
 				conn_latency, supervision_timeout);
 
-	*evt = cmd_status((!status) ? 0x00 : BT_HCI_ERR_CMD_DISALLOWED);
+	*evt = cmd_status(status);
 }
 
 static void le_conn_param_req_reply(struct net_buf *buf, struct net_buf **evt)
@@ -1100,7 +1165,7 @@ static void le_conn_param_req_reply(struct net_buf *buf, struct net_buf **evt)
 				timeout);
 
 	rp = cmd_complete(evt, sizeof(*rp));
-	rp->status = (!status) ?  0x00 : BT_HCI_ERR_CMD_DISALLOWED;
+	rp->status = status;
 	rp->handle = sys_cpu_to_le16(handle);
 }
 
@@ -1116,7 +1181,7 @@ static void le_conn_param_req_neg_reply(struct net_buf *buf,
 	status = ll_conn_update(handle, 2, cmd->reason, 0, 0, 0);
 
 	rp = cmd_complete(evt, sizeof(*rp));
-	rp->status = (!status) ?  0x00 : BT_HCI_ERR_CMD_DISALLOWED;
+	rp->status = status;
 	rp->handle = sys_cpu_to_le16(handle);
 }
 
@@ -1220,16 +1285,45 @@ static void le_set_phy(struct net_buf *buf, struct net_buf **evt)
 	u32_t status;
 	u16_t handle;
 	u16_t phy_opts;
+	u8_t mask_phys;
 
 	handle = sys_le16_to_cpu(cmd->handle);
 	phy_opts = sys_le16_to_cpu(cmd->phy_opts);
 
+	mask_phys = 0x01;
+	if (IS_ENABLED(CONFIG_BT_CTLR_PHY_2M)) {
+		mask_phys |= BIT(1);
+	}
+	if (IS_ENABLED(CONFIG_BT_CTLR_PHY_CODED)) {
+		mask_phys |= BIT(2);
+	}
+
 	if (cmd->all_phys & BT_HCI_LE_PHY_TX_ANY) {
-		cmd->tx_phys = 0x07;
+		cmd->tx_phys = mask_phys;
 	}
 	if (cmd->all_phys & BT_HCI_LE_PHY_RX_ANY) {
-		cmd->rx_phys = 0x07;
+		cmd->rx_phys = mask_phys;
 	}
+
+	if (!(cmd->tx_phys & 0x07) ||
+	    !(cmd->rx_phys & 0x07)) {
+		struct bt_hci_evt_cc_status *ccst;
+
+		ccst = cmd_complete(evt, sizeof(*ccst));
+		ccst->status = BT_HCI_ERR_INVALID_PARAM;
+
+		return;
+	}
+
+	if ((cmd->tx_phys | cmd->rx_phys) & ~mask_phys) {
+		struct bt_hci_evt_cc_status *ccst;
+
+		ccst = cmd_complete(evt, sizeof(*ccst));
+		ccst->status = BT_HCI_ERR_UNSUPP_FEATURE_PARAM_VAL;
+
+		return;
+	}
+
 	if (phy_opts & 0x03) {
 		phy_opts -= 1;
 		phy_opts &= 1;
@@ -1673,10 +1767,12 @@ static void vs_read_supported_commands(struct net_buf *buf,
 
 	/* Set Version Information, Supported Commands, Supported Features. */
 	rp->commands[0] |= BIT(0) | BIT(1) | BIT(2);
-#if defined(CONFIG_BT_CTLR_HCI_VS_EXT)
+#if defined(CONFIG_BT_HCI_VS_EXT)
+	/* Write BD_ADDR, Read Build Info */
+	rp->commands[0] |= BIT(5) | BIT(7);
 	/* Read Static Addresses, Read Key Hierarchy Roots */
 	rp->commands[1] |= BIT(0) | BIT(1);
-#endif /* CONFIG_BT_CTLR_HCI_VS_EXT */
+#endif /* CONFIG_BT_HCI_VS_EXT */
 }
 
 static void vs_read_supported_features(struct net_buf *buf,
@@ -1690,7 +1786,41 @@ static void vs_read_supported_features(struct net_buf *buf,
 	memset(&rp->features[0], 0x00, sizeof(rp->features));
 }
 
-#if defined(CONFIG_BT_CTLR_HCI_VS_EXT)
+#if defined(CONFIG_BT_HCI_VS_EXT)
+static void vs_write_bd_addr(struct net_buf *buf, struct net_buf **evt)
+{
+	struct bt_hci_cp_vs_write_bd_addr *cmd = (void *)buf->data;
+	struct bt_hci_evt_cc_status *ccst;
+
+	ll_addr_set(0, &cmd->bdaddr.val[0]);
+
+	ccst = cmd_complete(evt, sizeof(*ccst));
+	ccst->status = 0x00;
+}
+
+static void vs_read_build_info(struct net_buf *buf, struct net_buf **evt)
+{
+	struct bt_hci_rp_vs_read_build_info *rp;
+
+#define BUILD_TIMESTAMP " " __DATE__ " " __TIME__
+
+#define HCI_VS_BUILD_INFO "Zephyr OS v" \
+	KERNEL_VERSION_STRING BUILD_TIMESTAMP CONFIG_BT_CTLR_HCI_VS_BUILD_INFO
+
+	const char build_info[] = HCI_VS_BUILD_INFO;
+
+#define BUILD_INFO_EVT_LEN (sizeof(struct bt_hci_evt_hdr) + \
+			    sizeof(struct bt_hci_evt_cmd_complete) + \
+			    sizeof(struct bt_hci_rp_vs_read_build_info) + \
+			    sizeof(build_info))
+
+	BUILD_ASSERT(CONFIG_BT_RX_BUF_LEN >= BUILD_INFO_EVT_LEN);
+
+	rp = cmd_complete(evt, sizeof(*rp) + sizeof(build_info));
+	rp->status = 0x00;
+	memcpy(rp->info, build_info, sizeof(build_info));
+}
+
 static void vs_read_static_addrs(struct net_buf *buf, struct net_buf **evt)
 {
 	struct bt_hci_rp_vs_read_static_addrs *rp;
@@ -1707,6 +1837,7 @@ static void vs_read_static_addrs(struct net_buf *buf, struct net_buf **evt)
 		struct bt_hci_vs_static_addr *addr;
 
 		rp = cmd_complete(evt, sizeof(*rp) + sizeof(*addr));
+		rp->status = 0x00;
 		rp->num_addrs = 1;
 
 		addr = &rp->a[0];
@@ -1776,7 +1907,7 @@ static void vs_read_key_hierarchy_roots(struct net_buf *buf,
 #endif /* CONFIG_SOC_FAMILY_NRF5 */
 }
 
-#endif /* CONFIG_BT_CTLR_HCI_VS_EXT */
+#endif /* CONFIG_BT_HCI_VS_EXT */
 
 static int vendor_cmd_handle(u16_t ocf, struct net_buf *cmd,
 			     struct net_buf **evt)
@@ -1794,7 +1925,15 @@ static int vendor_cmd_handle(u16_t ocf, struct net_buf *cmd,
 		vs_read_supported_features(cmd, evt);
 		break;
 
-#if defined(CONFIG_BT_CTLR_HCI_VS_EXT)
+#if defined(CONFIG_BT_HCI_VS_EXT)
+	case BT_OCF(BT_HCI_OP_VS_READ_BUILD_INFO):
+		vs_read_build_info(cmd, evt);
+		break;
+
+	case BT_OCF(BT_HCI_OP_VS_WRITE_BD_ADDR):
+		vs_write_bd_addr(cmd, evt);
+		break;
+
 	case BT_OCF(BT_HCI_OP_VS_READ_STATIC_ADDRS):
 		vs_read_static_addrs(cmd, evt);
 		break;
@@ -1802,7 +1941,7 @@ static int vendor_cmd_handle(u16_t ocf, struct net_buf *cmd,
 	case BT_OCF(BT_HCI_OP_VS_READ_KEY_HIERARCHY_ROOTS):
 		vs_read_key_hierarchy_roots(cmd, evt);
 		break;
-#endif /* CONFIG_BT_CTLR_HCI_VS_EXT */
+#endif /* CONFIG_BT_HCI_VS_EXT */
 
 	default:
 		return -EINVAL;
@@ -1811,6 +1950,21 @@ static int vendor_cmd_handle(u16_t ocf, struct net_buf *cmd,
 	return 0;
 }
 
+static void data_buf_overflow(struct net_buf **buf)
+{
+	struct bt_hci_evt_data_buf_overflow *ep;
+
+	if (!(event_mask & BT_EVT_MASK_DATA_BUFFER_OVERFLOW)) {
+		return;
+	}
+
+	*buf = bt_buf_get_rx(BT_BUF_EVT, K_FOREVER);
+	evt_create(*buf, BT_HCI_EVT_DATA_BUF_OVERFLOW, sizeof(*ep));
+	ep = net_buf_add(*buf, sizeof(*ep));
+
+	ep->link_type = BT_OVERFLOW_LINK_ACL;
+}
+
 struct net_buf *hci_cmd_handle(struct net_buf *cmd)
 {
 	struct bt_hci_evt_cc_status *ccst;
@@ -1869,7 +2023,7 @@ struct net_buf *hci_cmd_handle(struct net_buf *cmd)
 	return evt;
 }
 
-int hci_acl_handle(struct net_buf *buf)
+int hci_acl_handle(struct net_buf *buf, struct net_buf **evt)
 {
 	struct radio_pdu_node_tx *radio_pdu_node_tx;
 	struct bt_hci_acl_hdr *acl;
@@ -1878,6 +2032,8 @@ int hci_acl_handle(struct net_buf *buf)
 	u8_t flags;
 	u16_t len;
 
+	*evt = NULL;
+
 	if (buf->len < sizeof(*acl)) {
 		BT_ERR("No HCI ACL header");
 		return -EINVAL;
@@ -1900,6 +2056,7 @@ int hci_acl_handle(struct net_buf *buf)
 	radio_pdu_node_tx = radio_tx_mem_acquire();
 	if (!radio_pdu_node_tx) {
 		BT_ERR("Tx Buffer Overflow");
+		data_buf_overflow(evt);
 		return -ENOBUFS;
 	}
 
@@ -2221,19 +2378,20 @@ static void le_scan_req_received(struct pdu_data *pdu_data, u8_t *b,
 #endif /* CONFIG_BT_CTLR_SCAN_REQ_NOTIFY */
 
 #if defined(CONFIG_BT_CONN)
-static void le_conn_complete(struct pdu_data *pdu_data, u16_t handle,
-			     struct net_buf *buf)
+static void le_conn_complete(u8_t status, struct radio_le_conn_cmplt *radio_cc,
+			     u16_t handle, struct net_buf *buf)
 {
 	struct bt_hci_evt_le_conn_complete *lecc;
-	struct radio_le_conn_cmplt *radio_cc;
-
-	radio_cc = (struct radio_le_conn_cmplt *) (pdu_data->payload.lldata);
 
 #if defined(CONFIG_BT_CTLR_PRIVACY)
+	if (!status) {
 	/* Update current RPA */
-	ll_rl_crpa_set(radio_cc->peer_addr_type, &radio_cc->peer_addr[0],
-		       0xff, &radio_cc->peer_rpa[0]);
+		ll_rl_crpa_set(radio_cc->peer_addr_type,
+			       &radio_cc->peer_addr[0], 0xff,
+			       &radio_cc->peer_rpa[0]);
+	}
 #endif
+
 	if (!(event_mask & BT_EVT_MASK_LE_META_EVENT) ||
 	    (!(le_event_mask & BT_EVT_MASK_LE_CONN_COMPLETE) &&
 #if defined(CONFIG_BT_CTLR_PRIVACY)
@@ -2244,7 +2402,7 @@ static void le_conn_complete(struct pdu_data *pdu_data, u16_t handle,
 		return;
 	}
 
-	if (!radio_cc->status) {
+	if (!status) {
 		conn_count++;
 	}
 
@@ -2255,7 +2413,13 @@ static void le_conn_complete(struct pdu_data *pdu_data, u16_t handle,
 		leecc = meta_evt(buf, BT_HCI_EVT_LE_ENH_CONN_COMPLETE,
 				 sizeof(*leecc));
 
-		leecc->status = radio_cc->status;
+		if (status) {
+			memset(leecc, 0x00, sizeof(*leecc));
+			leecc->status = status;
+			return;
+		}
+
+		leecc->status = 0x00;
 		leecc->handle = sys_cpu_to_le16(handle);
 		leecc->role = radio_cc->role;
 
@@ -2287,7 +2451,13 @@ static void le_conn_complete(struct pdu_data *pdu_data, u16_t handle,
 
 	lecc = meta_evt(buf, BT_HCI_EVT_LE_CONN_COMPLETE, sizeof(*lecc));
 
-	lecc->status = radio_cc->status;
+	if (status) {
+		memset(lecc, 0x00, sizeof(*lecc));
+		lecc->status = status;
+		return;
+	}
+
+	lecc->status = 0x00;
 	lecc->handle = sys_cpu_to_le16(handle);
 	lecc->role = radio_cc->role;
 	lecc->peer_addr.type = radio_cc->peer_addr_type;
@@ -2314,6 +2484,13 @@ static void disconn_complete(struct pdu_data *pdu_data, u16_t handle,
 	ep->handle = sys_cpu_to_le16(handle);
 	ep->reason = *((u8_t *)pdu_data);
 
+#if defined(CONFIG_BT_HCI_ACL_FLOW_CONTROL)
+	/* Clear any pending packets upon disconnection */
+	/* Note: This requires linear handle values starting from 0 */
+	LL_ASSERT(handle < ARRAY_SIZE(hci_hbuf_pend));
+	hci_hbuf_acked += hci_hbuf_pend[handle];
+	hci_hbuf_pend[handle] = 0;
+#endif /* CONFIG_BT_HCI_ACL_FLOW_CONTROL */
 	conn_count--;
 }
 
@@ -2457,7 +2634,12 @@ static void encode_control(struct radio_pdu_node_rx *node_rx,
 
 #if defined(CONFIG_BT_CONN)
 	case NODE_RX_TYPE_CONNECTION:
-		le_conn_complete(pdu_data, handle, buf);
+		{
+			struct radio_le_conn_cmplt *cc;
+
+			cc = (void *)pdu_data->payload.lldata;
+			le_conn_complete(cc->status, cc, handle, buf);
+		}
 		break;
 
 	case NODE_RX_TYPE_TERMINATE:
@@ -2753,6 +2935,11 @@ void hci_acl_encode(struct radio_pdu_node_rx *node_rx, struct net_buf *buf)
 			LL_ASSERT((hci_hbuf_sent - hci_hbuf_acked) <
 				  hci_hbuf_total);
 			hci_hbuf_sent++;
+			/* Note: This requires linear handle values starting
+			 * from 0
+			 */
+			LL_ASSERT(handle < ARRAY_SIZE(hci_hbuf_pend));
+			hci_hbuf_pend[handle]++;
 		}
 #endif
 		break;

subsys/bluetooth/controller/hci/hci_driver.c

@@ -186,11 +186,14 @@ static inline struct net_buf *process_node(struct radio_pdu_node_rx *node_rx)
 }
 
 #if defined(CONFIG_BT_HCI_ACL_FLOW_CONTROL)
-static inline struct net_buf *process_hbuf(void)
+static inline struct net_buf *process_hbuf(struct radio_pdu_node_rx *n)
 {
 	/* shadow total count in case of preemption */
+	struct radio_pdu_node_rx *node_rx = NULL;
 	s32_t hbuf_total = hci_hbuf_total;
 	struct net_buf *buf = NULL;
+	sys_snode_t *node = NULL;
+	s8_t class;
 	int reset;
 
 	reset = atomic_test_and_clear_bit(&hci_state_mask, HCI_STATE_BIT_RESET);
@@ -199,67 +202,73 @@ static inline struct net_buf *process_hbuf(void)
 		sys_slist_init(&hbuf_pend);
 	}
 
-	if (hbuf_total > 0) {
-		struct radio_pdu_node_rx *node_rx = NULL;
-		s8_t class, next_class = -1;
-		sys_snode_t *node = NULL;
+	if (hbuf_total <= 0) {
+		hbuf_count = -1;
+		return NULL;
+	}
 
-		/* available host buffers */
+	/* available host buffers */
+	hbuf_count = hbuf_total - (hci_hbuf_sent - hci_hbuf_acked);
+
+	/* host acked ACL packets, try to dequeue from hbuf */
+	node = sys_slist_peek_head(&hbuf_pend);
+	if (!node) {
+		return NULL;
+	}
+
+	/* Return early if this iteration already has a node to process */
+	node_rx = NODE_RX(node);
+	class = hci_get_class(node_rx);
+	if (n) {
+		if (class == HCI_CLASS_EVT_CONNECTION ||
+		    (class == HCI_CLASS_ACL_DATA && hbuf_count)) {
+			/* node to process later, schedule an iteration */
+			BT_DBG("FC: signalling");
+			k_poll_signal(&hbuf_signal, 0x0);
+		}
+		return NULL;
+	}
+
+	switch (class) {
+	case HCI_CLASS_EVT_CONNECTION:
+		BT_DBG("FC: dequeueing event");
+		(void) sys_slist_get(&hbuf_pend);
+		break;
+	case HCI_CLASS_ACL_DATA:
+		if (hbuf_count) {
+			BT_DBG("FC: dequeueing ACL data");
+			(void) sys_slist_get(&hbuf_pend);
+		} else {
+			/* no buffers, HCI will signal */
+			node = NULL;
+		}
+		break;
+	case HCI_CLASS_EVT_DISCARDABLE:
+	case HCI_CLASS_EVT_REQUIRED:
+	default:
+		LL_ASSERT(0);
+		break;
+	}
+
+	if (node) {
+		buf = encode_node(node_rx, class);
+		/* Update host buffers after encoding */
 		hbuf_count = hbuf_total - (hci_hbuf_sent - hci_hbuf_acked);
-
-		/* host acked ACL packets, try to dequeue from hbuf */
+		/* next node */
 		node = sys_slist_peek_head(&hbuf_pend);
 		if (node) {
 			node_rx = NODE_RX(node);
 			class = hci_get_class(node_rx);
-			switch (class) {
-			case HCI_CLASS_EVT_CONNECTION:
-				BT_DBG("FC: dequeueing event");
-				node = sys_slist_get(&hbuf_pend);
-				break;
-			case HCI_CLASS_ACL_DATA:
-				if (hbuf_count) {
-					BT_DBG("FC: dequeueing ACL data");
-					node = sys_slist_get(&hbuf_pend);
-					hbuf_count--;
-				} else {
-					/* no buffers, HCI will signal */
-					node = NULL;
-				}
-				break;
-			case HCI_CLASS_EVT_DISCARDABLE:
-			case HCI_CLASS_EVT_REQUIRED:
-			default:
-				LL_ASSERT(0);
-				break;
-			}
 
-			if (node) {
-				struct radio_pdu_node_rx *next;
-				bool empty = true;
-
-				node_rx = NODE_RX(node);
-				node = sys_slist_peek_head(&hbuf_pend);
-				if (node) {
-					next = NODE_RX(node);
-					next_class = hci_get_class(next);
-				}
-				empty = sys_slist_is_empty(&hbuf_pend);
-
-				buf = encode_node(node_rx, class);
-				if (!empty && (class == HCI_CLASS_EVT_CONNECTION ||
-					       (class == HCI_CLASS_ACL_DATA &&
-						hbuf_count))) {
-					/* more to process, schedule an
-					 * iteration
-					 */
-					BT_DBG("FC: signalling");
-					k_poll_signal(&hbuf_signal, 0x0);
-				}
+			if (class == HCI_CLASS_EVT_CONNECTION ||
+			    (class == HCI_CLASS_ACL_DATA && hbuf_count)) {
+				/* more to process, schedule an
+				 * iteration
+				 */
+				BT_DBG("FC: signalling");
+				k_poll_signal(&hbuf_signal, 0x0);
 			}
 		}
-	} else {
-		hbuf_count = -1;
 	}
 
 	return buf;
@@ -301,7 +310,7 @@ static void recv_thread(void *p1, void *p2, void *p3)
 		events[1].state = K_POLL_STATE_NOT_READY;
 
 		/* process host buffers first if any */
-		buf = process_hbuf();
+		buf = process_hbuf(node_rx);
 
 #else
 		node_rx = k_fifo_get(&recv_fifo, K_FOREVER);
@@ -347,6 +356,22 @@ static int cmd_handle(struct net_buf *buf)
 	return 0;
 }
 
+#if defined(CONFIG_BT_CONN)
+static int acl_handle(struct net_buf *buf)
+{
+	struct net_buf *evt;
+	int err;
+
+	err = hci_acl_handle(buf, &evt);
+	if (evt) {
+		BT_DBG("Replying with event of %u bytes", evt->len);
+		bt_recv_prio(evt);
+	}
+
+	return err;
+}
+#endif /* CONFIG_BT_CONN */
+
 static int hci_driver_send(struct net_buf *buf)
 {
 	u8_t type;
@@ -363,9 +388,9 @@ static int hci_driver_send(struct net_buf *buf)
 	switch (type) {
 #if defined(CONFIG_BT_CONN)
 	case BT_BUF_ACL_OUT:
-		err = hci_acl_handle(buf);
+		err = acl_handle(buf);
 		break;
-#endif
+#endif /* CONFIG_BT_CONN */
 	case BT_BUF_CMD:
 		err = cmd_handle(buf);
 		break;

subsys/bluetooth/controller/hci/hci_internal.h

@@ -39,7 +39,7 @@ struct net_buf *hci_cmd_handle(struct net_buf *cmd);
 void hci_evt_encode(struct radio_pdu_node_rx *node_rx, struct net_buf *buf);
 s8_t hci_get_class(struct radio_pdu_node_rx *node_rx);
 #if defined(CONFIG_BT_CONN)
-int hci_acl_handle(struct net_buf *acl);
+int hci_acl_handle(struct net_buf *acl, struct net_buf **evt);
 void hci_acl_encode(struct radio_pdu_node_rx *node_rx, struct net_buf *buf);
 void hci_num_cmplt_encode(struct net_buf *buf, u16_t handle, u8_t num);
 #endif

subsys/bluetooth/controller/include/ll.h

@@ -13,7 +13,7 @@ void ll_reset(void);
 void ll_radio_state_abort(void);
 u32_t ll_radio_state_is_idle(void);
 u8_t *ll_addr_get(u8_t addr_type, u8_t *p_bdaddr);
-void ll_addr_set(u8_t addr_type, u8_t const *const p_bdaddr);
+u32_t ll_addr_set(u8_t addr_type, u8_t const *const p_bdaddr);
 
 #if defined(CONFIG_BT_CTLR_ADV_EXT)
 u32_t ll_adv_params_set(u8_t handle, u16_t evt_prop, u32_t interval,

subsys/bluetooth/controller/ll_sw/Makefile

@@ -2,6 +2,8 @@ ccflags-y += -I$(srctree)/subsys/bluetooth/controller/include
 ccflags-y += -I$(srctree)/subsys/bluetooth/controller
 ccflags-y += -I$(srctree)/subsys/bluetooth
 
+ccflags-$(CONFIG_BT_CTLR_FAST_ENC) += -Ofast
+
 obj-y += crypto.o ctrl.o ll.o ll_filter.o
 obj-$(CONFIG_BT_BROADCASTER) += ll_adv.o
 obj-$(CONFIG_BT_OBSERVER)    += ll_scan.o

subsys/bluetooth/controller/ll_sw/ctrl.h

@@ -175,17 +175,12 @@
  ****************************************************************************/
 /* Minimum LL Payload support (Dont change). */
 #define RADIO_LL_LENGTH_OCTETS_RX_MIN	27
-#define RADIO_LL_LENGTH_TIME_RX_MIN	(((RADIO_LL_LENGTH_OCTETS_RX_MIN) \
-						+ 14) * 8 \
-					)
 
 /* Maximum LL Payload support (27 to 251). */
 #ifndef RADIO_LL_LENGTH_OCTETS_RX_MAX
 #define RADIO_LL_LENGTH_OCTETS_RX_MAX	251
 #endif
-#define RADIO_LL_LENGTH_TIME_RX_MAX	(((RADIO_LL_LENGTH_OCTETS_RX_MAX) \
-						+ 14) * 8 \
-					)
+
 /* Implementation default L2CAP MTU */
 #ifndef RADIO_L2CAP_MTU_MAX
 #define RADIO_L2CAP_MTU_MAX		(RADIO_LL_LENGTH_OCTETS_RX_MAX - 4)

subsys/bluetooth/controller/ll_sw/ctrl_internal.h

@@ -165,6 +165,7 @@ struct connection {
 #endif /* CONFIG_BT_CTLR_PHY */
 
 		struct {
+			u8_t  initiate;
 			u8_t  error_code;
 			u8_t  rand[8];
 			u8_t  ediv[2];
@@ -207,6 +208,7 @@ struct connection {
 			LLCP_CPR_STATE_UPD
 		} state:3 __packed;
 		u8_t  cmd:1;
+		u8_t  disabled:1;
 		u8_t  status;
 		u16_t interval;
 		u16_t latency;

subsys/bluetooth/controller/ll_sw/ll.c

@@ -222,9 +222,11 @@ int ll_init(struct k_sem *sem_rx)
 	_ticker_users[MAYFLY_CALL_ID_2][0] = 0;
 	_ticker_users[MAYFLY_CALL_ID_PROGRAM][0] = TICKER_USER_APP_OPS;
 
-	ticker_init(RADIO_TICKER_INSTANCE_ID_RADIO, TICKER_NODES,
-		    &_ticker_nodes[0], MAYFLY_CALLER_COUNT, &_ticker_users[0],
-		    TICKER_USER_OPS, &_ticker_user_ops[0]);
+	err = ticker_init(RADIO_TICKER_INSTANCE_ID_RADIO,
+			  TICKER_NODES, &_ticker_nodes[0],
+			  MAYFLY_CALLER_COUNT, &_ticker_users[0],
+			  TICKER_USER_OPS, &_ticker_user_ops[0]);
+	LL_ASSERT(!err);
 
 	clk_m16 = device_get_binding(CONFIG_CLOCK_CONTROL_NRF5_M16SRC_DRV_NAME);
 	if (!clk_m16) {
@@ -288,11 +290,18 @@ u8_t *ll_addr_get(u8_t addr_type, u8_t *bdaddr)
 	return _ll_context.pub_addr;
 }
 
-void ll_addr_set(u8_t addr_type, u8_t const *const bdaddr)
+u32_t ll_addr_set(u8_t addr_type, u8_t const *const bdaddr)
 {
+	if (radio_adv_is_enabled() ||
+	    (radio_scan_is_enabled() & (BIT(1) | BIT(2)))) {
+		return BT_HCI_ERR_CMD_DISALLOWED;
+	}
+
 	if (addr_type) {
 		memcpy(_ll_context.rnd_addr, bdaddr, BDADDR_SIZE);
 	} else {
 		memcpy(_ll_context.pub_addr, bdaddr, BDADDR_SIZE);
 	}
+
+	return 0;
 }

subsys/bluetooth/controller/ll_sw/ll_test.c

@@ -9,8 +9,10 @@
 
 #include <toolchain.h>
 #include <zephyr/types.h>
+#include <soc.h>
 #include <clock_control.h>
 
+#include "hal/cpu.h"
 #include "hal/cntr.h"
 #include "hal/ccm.h"
 #include "hal/radio.h"
@@ -72,20 +74,25 @@ static const u8_t prbs9[] = {
 /* TODO: fill correct prbs15 */
 static const u8_t prbs15[255] = { 0x00, };
 
+static u8_t tx_req;
+static u8_t volatile tx_ack;
+
 static void isr_tx(void)
 {
-	u8_t trx_done;
 	u32_t l, i, s, t;
 
-	/* Read radio status and events */
-	trx_done = radio_is_done();
-
 	/* Clear radio status and events */
 	radio_status_reset();
 	radio_tmr_status_reset();
 
+#if defined(CONFIG_BT_CTLR_GPIO_PA_PIN)
+	radio_gpio_pa_lna_disable();
+#endif /* CONFIG_BT_CTLR_GPIO_PA_PIN */
+
 	/* Exit if radio disabled */
-	if (!trx_done) {
+	if (((tx_req - tx_ack) & 0x01) == 0) {
+		tx_ack = tx_req;
+
 		return;
 	}
 
@@ -108,7 +115,14 @@ static void isr_tx(void)
 	radio_tmr_aa_capture();
 	radio_tmr_end_capture();
 
-	/* TODO: check for probable stall timer capture being set */
+	/* TODO: check for probable stale timer capture being set */
+
+#if defined(CONFIG_BT_CTLR_GPIO_PA_PIN)
+	radio_gpio_pa_setup();
+	radio_gpio_pa_lna_enable(t + radio_tx_ready_delay_get(test_phy,
+							      test_phy_flags) -
+				 CONFIG_BT_CTLR_GPIO_PA_OFFSET);
+#endif /* CONFIG_BT_CTLR_GPIO_PA_PIN */
 }
 
 static void isr_rx(void)
@@ -171,6 +185,7 @@ static u32_t init(u8_t chan, u8_t phy, void (*isr)(void))
 	/* Setup Radio in Tx/Rx */
 	/* NOTE: No whitening in test mode. */
 	radio_phy_set(test_phy, test_phy_flags);
+	radio_tmr_tifs_set(150);
 	radio_tx_power_set(0);
 	radio_freq_chan_set((chan << 1) + 2);
 	radio_aa_set((u8_t *)&test_sync_word);
@@ -182,6 +197,7 @@ static u32_t init(u8_t chan, u8_t phy, void (*isr)(void))
 
 u32_t ll_test_tx(u8_t chan, u8_t len, u8_t type, u8_t phy)
 {
+	u32_t start_us;
 	u8_t *payload;
 	u8_t *pdu;
 	u32_t err;
@@ -195,6 +211,8 @@ u32_t ll_test_tx(u8_t chan, u8_t len, u8_t type, u8_t phy)
 		return err;
 	}
 
+	tx_req++;
+
 	pdu = radio_pkt_scratch_get();
 	payload = &pdu[2];
 
@@ -237,10 +255,20 @@ u32_t ll_test_tx(u8_t chan, u8_t len, u8_t type, u8_t phy)
 
 	radio_pkt_tx_set(pdu);
 	radio_switch_complete_and_disable();
-	radio_tmr_start(1, cntr_cnt_get() + CNTR_MIN_DELTA, 0);
+	start_us = radio_tmr_start(1, cntr_cnt_get() + CNTR_MIN_DELTA, 0);
 	radio_tmr_aa_capture();
 	radio_tmr_end_capture();
 
+#if defined(CONFIG_BT_CTLR_GPIO_PA_PIN)
+	radio_gpio_pa_setup();
+	radio_gpio_pa_lna_enable(start_us +
+				 radio_tx_ready_delay_get(test_phy,
+							  test_phy_flags) -
+				 CONFIG_BT_CTLR_GPIO_PA_OFFSET);
+#else /* !CONFIG_BT_CTLR_GPIO_PA_PIN */
+	ARG_UNUSED(start_us);
+#endif /* !CONFIG_BT_CTLR_GPIO_PA_PIN */
+
 	started = true;
 
 	return 0;
@@ -263,6 +291,10 @@ u32_t ll_test_rx(u8_t chan, u8_t phy, u8_t mod_idx)
 	radio_switch_complete_and_rx(test_phy);
 	radio_tmr_start(0, cntr_cnt_get() + CNTR_MIN_DELTA, 0);
 
+#if defined(CONFIG_BT_CTLR_GPIO_LNA_PIN)
+	radio_gpio_lna_on();
+#endif /* !CONFIG_BT_CTLR_GPIO_LNA_PIN */
+
 	started = true;
 
 	return 0;
@@ -271,6 +303,7 @@ u32_t ll_test_rx(u8_t chan, u8_t phy, u8_t mod_idx)
 u32_t ll_test_end(u16_t *num_rx)
 {
 	struct device *hf_clock;
+	u8_t ack;
 
 	if (!started) {
 		return 1;
@@ -280,8 +313,17 @@ u32_t ll_test_end(u16_t *num_rx)
 	*num_rx = test_num_rx;
 	test_num_rx = 0;
 
-	/* Disable Radio */
-	radio_disable();
+	/* Disable Radio, if in Rx test */
+	ack = tx_ack;
+	if (tx_req == ack) {
+		radio_disable();
+	} else {
+		/* Wait for Tx to complete */
+		tx_req = ack + 2;
+		while (tx_req != tx_ack) {
+			cpu_sleep();
+		}
+	}
 
 	/* Stop packet timer */
 	radio_tmr_stop();
@@ -293,6 +335,10 @@ u32_t ll_test_end(u16_t *num_rx)
 	/* Stop coarse timer */
 	cntr_stop();
 
+#if defined(CONFIG_BT_CTLR_GPIO_LNA_PIN)
+	radio_gpio_lna_off();
+#endif /* !CONFIG_BT_CTLR_GPIO_LNA_PIN */
+
 	started = false;
 
 	return 0;

subsys/bluetooth/controller/ll_sw/pdu.h

@@ -224,6 +224,14 @@ struct pdu_data_llctrl_enc_rsp {
 	u8_t ivs[4];
 } __packed;
 
+struct pdu_data_llctrl_start_enc_req {
+	/* no members */
+} __packed;
+
+struct pdu_data_llctrl_start_enc_rsp {
+	/* no members */
+} __packed;
+
 struct pdu_data_llctrl_unknown_rsp {
 	u8_t type;
 } __packed;
@@ -236,6 +244,14 @@ struct pdu_data_llctrl_feature_rsp {
 	u8_t features[8];
 } __packed;
 
+struct pdu_data_llctrl_pause_enc_req {
+	/* no members */
+} __packed;
+
+struct pdu_data_llctrl_pause_enc_rsp {
+	/* no members */
+} __packed;
+
 struct pdu_data_llctrl_version_ind {
 	u8_t  version_number;
 	u16_t company_id;
@@ -246,6 +262,10 @@ struct pdu_data_llctrl_reject_ind {
 	u8_t error_code;
 } __packed;
 
+struct pdu_data_llctrl_slave_feature_req {
+	u8_t features[8];
+} __packed;
+
 struct pdu_data_llctrl_conn_param_req {
 	u16_t interval_min;
 	u16_t interval_max;
@@ -281,14 +301,34 @@ struct pdu_data_llctrl_reject_ext_ind {
 	u8_t error_code;
 } __packed;
 
-struct pdu_data_llctrl_length_req_rsp {
+struct pdu_data_llctrl_ping_req {
+	/* no members */
+} __packed;
+
+struct pdu_data_llctrl_ping_rsp {
+	/* no members */
+} __packed;
+
+struct pdu_data_llctrl_length_req {
 	u16_t max_rx_octets;
 	u16_t max_rx_time;
 	u16_t max_tx_octets;
 	u16_t max_tx_time;
 } __packed;
 
-struct pdu_data_llctrl_phy_req_rsp {
+struct pdu_data_llctrl_length_rsp {
+	u16_t max_rx_octets;
+	u16_t max_rx_time;
+	u16_t max_tx_octets;
+	u16_t max_tx_time;
+} __packed;
+
+struct pdu_data_llctrl_phy_req {
+	u8_t tx_phys;
+	u8_t rx_phys;
+} __packed;
+
+struct pdu_data_llctrl_phy_rsp {
 	u8_t tx_phys;
 	u8_t rx_phys;
 } __packed;
@@ -312,19 +352,25 @@ struct pdu_data_llctrl {
 		struct pdu_data_llctrl_terminate_ind terminate_ind;
 		struct pdu_data_llctrl_enc_req enc_req;
 		struct pdu_data_llctrl_enc_rsp enc_rsp;
+		struct pdu_data_llctrl_start_enc_req start_enc_req;
+		struct pdu_data_llctrl_start_enc_rsp start_enc_rsp;
 		struct pdu_data_llctrl_unknown_rsp unknown_rsp;
 		struct pdu_data_llctrl_feature_req feature_req;
 		struct pdu_data_llctrl_feature_rsp feature_rsp;
+		struct pdu_data_llctrl_pause_enc_req pause_enc_req;
+		struct pdu_data_llctrl_pause_enc_rsp pause_enc_rsp;
 		struct pdu_data_llctrl_version_ind version_ind;
 		struct pdu_data_llctrl_reject_ind reject_ind;
-		struct pdu_data_llctrl_feature_req slave_feature_req;
+		struct pdu_data_llctrl_slave_feature_req slave_feature_req;
 		struct pdu_data_llctrl_conn_param_req conn_param_req;
 		struct pdu_data_llctrl_conn_param_rsp conn_param_rsp;
 		struct pdu_data_llctrl_reject_ext_ind reject_ext_ind;
-		struct pdu_data_llctrl_length_req_rsp length_req;
-		struct pdu_data_llctrl_length_req_rsp length_rsp;
-		struct pdu_data_llctrl_phy_req_rsp phy_req;
-		struct pdu_data_llctrl_phy_req_rsp phy_rsp;
+		struct pdu_data_llctrl_ping_req ping_req;
+		struct pdu_data_llctrl_ping_rsp ping_rsp;
+		struct pdu_data_llctrl_length_req length_req;
+		struct pdu_data_llctrl_length_rsp length_rsp;
+		struct pdu_data_llctrl_phy_req phy_req;
+		struct pdu_data_llctrl_phy_rsp phy_rsp;
 		struct pdu_data_llctrl_phy_upd_ind phy_upd_ind;
 		struct pdu_data_llctrl_min_used_chans_ind min_used_chans_ind;
 	} __packed ctrldata;

subsys/bluetooth/controller/ticker/ticker.c

@@ -39,8 +39,8 @@ struct ticker_node {
 	ticker_timeout_func timeout_func;
 	void  *context;
 
-	u16_t ticks_to_expire_minus;
-	u16_t ticks_slot;
+	u32_t ticks_to_expire_minus;
+	u32_t ticks_slot;
 	u16_t lazy_periodic;
 	u16_t lazy_current;
 	u32_t remainder_periodic;
@@ -62,7 +62,7 @@ struct ticker_user_op_start {
 	u32_t ticks_periodic;
 	u32_t remainder_periodic;
 	u16_t lazy;
-	u16_t ticks_slot;
+	u32_t ticks_slot;
 	ticker_timeout_func fp_timeout_func;
 	void  *context;
 };
@@ -112,9 +112,9 @@ struct ticker_instance {
 	u8_t  ticks_elapsed_last;
 	u32_t ticks_elapsed[DOUBLE_BUFFER_SIZE];
 	u32_t ticks_current;
-	u8_t  ticker_id_head;
+	u32_t ticks_slot_previous;
 	u8_t  ticker_id_slot_previous;
-	u16_t ticks_slot_previous;
+	u8_t  ticker_id_head;
 	u8_t  job_guard;
 	u8_t  worker_trigger;
 	u8_t  (*fp_caller_id_get)(u8_t user_id);
@@ -416,7 +416,7 @@ static void ticks_to_expire_prep(struct ticker_node *ticker,
 				 u32_t ticks_current, u32_t ticks_at_start)
 {
 	u32_t ticks_to_expire = ticker->ticks_to_expire;
-	u16_t ticks_to_expire_minus = ticker->ticks_to_expire_minus;
+	u32_t ticks_to_expire_minus = ticker->ticks_to_expire_minus;
 
 	/* Calculate ticks to expire for this new node */
 	if (((ticks_at_start - ticks_current) & BIT(23)) == 0) {
@@ -833,6 +833,20 @@ static inline u32_t ticker_job_insert(struct ticker_instance *instance,
 			ticker->ticks_to_expire += ticker->ticks_periodic +
 						   ticker_remainder_inc(ticker);
 			ticker->lazy_current++;
+
+			/* Remove any accumulated drift (possibly added due to
+			 * ticker job execution latencies).
+			 */
+			if (ticker->ticks_to_expire >
+			    ticker->ticks_to_expire_minus) {
+				ticker->ticks_to_expire -=
+					ticker->ticks_to_expire_minus;
+				ticker->ticks_to_expire_minus = 0;
+			} else {
+				ticker->ticks_to_expire_minus -=
+					ticker->ticks_to_expire;
+				ticker->ticks_to_expire = 0;
+			}
 		} else {
 			return TICKER_STATUS_FAILURE;
 		}
@@ -1522,7 +1536,7 @@ void ticker_trigger(u8_t instance_index)
 
 u32_t ticker_start(u8_t instance_index, u8_t user_id, u8_t ticker_id,
 		   u32_t ticks_anchor, u32_t ticks_first, u32_t ticks_periodic,
-		   u32_t remainder_periodic, u16_t lazy, u16_t ticks_slot,
+		   u32_t remainder_periodic, u16_t lazy, u32_t ticks_slot,
 		   ticker_timeout_func ticker_timeout_func, void *context,
 		   ticker_op_func fp_op_func, void *op_context)
 {

subsys/bluetooth/controller/ticker/ticker.h

@@ -64,7 +64,7 @@
 
 /** \brief Timer node type size.
 */
-#define TICKER_NODE_T_SIZE	36
+#define TICKER_NODE_T_SIZE	40
 
 /** \brief Timer user type size.
 */
@@ -72,7 +72,7 @@
 
 /** \brief Timer user operation type size.
 */
-#define TICKER_USER_OP_T_SIZE	44
+#define TICKER_USER_OP_T_SIZE	48
 
 /** \brief Timer timeout function type.
 */
@@ -100,7 +100,7 @@ bool ticker_is_initialized(u8_t instance_index);
 void ticker_trigger(u8_t instance_index);
 u32_t ticker_start(u8_t instance_index, u8_t user_id, u8_t ticker_id,
 		   u32_t ticks_anchor, u32_t ticks_first, u32_t ticks_periodic,
-		   u32_t remainder_periodic, u16_t lazy, u16_t ticks_slot,
+		   u32_t remainder_periodic, u16_t lazy, u32_t ticks_slot,
 		   ticker_timeout_func ticker_timeout_func, void *context,
 		   ticker_op_func fp_op_func, void *op_context);
 u32_t ticker_update(u8_t instance_index, u8_t user_id, u8_t ticker_id,

subsys/bluetooth/host/mesh/Kconfig

@@ -67,14 +67,6 @@ endif # BT_MESH_PROXY
 
 endif # BT_CONN
 
-config BT_MESH_LOCAL_INTERFACE
-	bool "Local network interface"
-	default y
-	help
-	  This is needed in order to send messages between two local Mesh
-	  elements. Only disable it if you're sure this will not be needed
-	  (which helps save a little bit of memory).
-
 config BT_MESH_SELF_TEST
 	bool "Perform self-tests"
 	help

subsys/bluetooth/host/mesh/access.c

@@ -103,15 +103,15 @@ static void mod_publish(struct k_work *work)
 
 	BT_DBG("");
 
-	if (pub->func) {
-		pub->func(pub->mod);
-	}
-
 	period_ms = bt_mesh_model_pub_period_get(pub->mod);
 	BT_DBG("period %u ms", period_ms);
 	if (period_ms) {
 		k_delayed_work_submit(&pub->timer, period_ms);
 	}
+
+	if (pub->func) {
+		pub->func(pub->mod);
+	}
 }
 
 static void mod_init(struct bt_mesh_model *mod, struct bt_mesh_elem *elem,

subsys/bluetooth/host/mesh/cfg.c

@@ -83,6 +83,10 @@ static void hb_send(struct bt_mesh_model *model)
 		feat |= BT_MESH_FEAT_RELAY;
 	}
 
+	if (bt_mesh_gatt_proxy_get() == BT_MESH_GATT_PROXY_ENABLED) {
+		feat |= BT_MESH_FEAT_PROXY;
+	}
+
 	if (bt_mesh_friend_get() == BT_MESH_FRIEND_ENABLED) {
 		feat |= BT_MESH_FEAT_FRIEND;
 	}
@@ -95,7 +99,7 @@ static void hb_send(struct bt_mesh_model *model)
 
 	hb.feat = sys_cpu_to_be16(feat);
 
-	BT_DBG("InitTTL %u feat 0x%02x", cfg->hb_pub.ttl, feat);
+	BT_DBG("InitTTL %u feat 0x%04x", cfg->hb_pub.ttl, feat);
 
 	bt_mesh_ctl_send(&tx, TRANS_CTL_OP_HEARTBEAT, &hb, sizeof(hb), NULL);
 }
@@ -143,6 +147,14 @@ static int comp_get_page_0(struct net_buf_simple *buf)
 		feat |= BT_MESH_FEAT_RELAY;
 	}
 
+	if (IS_ENABLED(CONFIG_BT_MESH_GATT_PROXY)) {
+		feat |= BT_MESH_FEAT_PROXY;
+	}
+
+	if (IS_ENABLED(CONFIG_BT_MESH_FRIEND)) {
+		feat |= BT_MESH_FEAT_FRIEND;
+	}
+
 	if (IS_ENABLED(CONFIG_BT_MESH_LOW_POWER)) {
 		feat |= BT_MESH_FEAT_LOW_POWER;
 	}
@@ -1212,11 +1224,7 @@ static void send_mod_sub_status(struct bt_mesh_model *model,
 
 	net_buf_simple_add_u8(msg, status);
 	net_buf_simple_add_le16(msg, elem_addr);
-	if (status) {
-		net_buf_simple_add_le16(msg, BT_MESH_ADDR_UNASSIGNED);
-	} else {
-		net_buf_simple_add_le16(msg, sub_addr);
-	}
+	net_buf_simple_add_le16(msg, sub_addr);
 
 	if (vnd) {
 		memcpy(net_buf_simple_add(msg, 4), mod_id, 4);
@@ -1694,7 +1702,7 @@ static void mod_sub_va_overwrite(struct bt_mesh_model *model,
 				 struct bt_mesh_msg_ctx *ctx,
 				 struct net_buf_simple *buf)
 {
-	u16_t elem_addr, sub_addr;
+	u16_t elem_addr, sub_addr = BT_MESH_ADDR_UNASSIGNED;
 	struct bt_mesh_model *mod;
 	struct bt_mesh_elem *elem;
 	u8_t *label_uuid;
@@ -2489,12 +2497,17 @@ static void lpn_timeout_get(struct bt_mesh_model *model,
 	BT_DBG("net_idx 0x%04x app_idx 0x%04x src 0x%04x lpn_addr 0x%02x",
 	       ctx->net_idx, ctx->app_idx, ctx->addr, lpn_addr);
 
+	if (!BT_MESH_ADDR_IS_UNICAST(lpn_addr)) {
+		BT_WARN("Invalid LPNAddress; ignoring msg");
+		return;
+	}
+
 	bt_mesh_model_msg_init(msg, OP_LPN_TIMEOUT_STATUS);
 	net_buf_simple_add_le16(msg, lpn_addr);
 	memset(net_buf_simple_add(msg, 3), 0, 3);
 
 	if (bt_mesh_model_send(model, ctx, msg, NULL, NULL)) {
-		BT_ERR("Unable to send Friend Status");
+		BT_ERR("Unable to send LPN PollTimeout Status");
 	}
 }
 
@@ -2577,7 +2590,7 @@ static void krp_set(struct bt_mesh_model *model, struct bt_mesh_msg_ctx *ctx,
 	} else if ((sub->kr_phase == BT_MESH_KR_PHASE_1 ||
 		    sub->kr_phase == BT_MESH_KR_PHASE_2) &&
 		   phase == BT_MESH_KR_PHASE_3) {
-		memcpy(&sub->keys[0], &sub->keys[1], sizeof(sub->keys[0]));
+		bt_mesh_net_revoke_keys(sub);
 		if (IS_ENABLED(CONFIG_BT_MESH_LOW_POWER) ||
 		    IS_ENABLED(CONFIG_BT_MESH_FRIEND)) {
 			bt_mesh_friend_cred_refresh(ctx->net_idx);
@@ -2652,18 +2665,18 @@ send:
 	bt_mesh_model_send(model, ctx, msg, NULL, NULL);
 }
 
-static void hearbeat_pub_get(struct bt_mesh_model *model,
-			     struct bt_mesh_msg_ctx *ctx,
-			     struct net_buf_simple *buf)
+static void heartbeat_pub_get(struct bt_mesh_model *model,
+			      struct bt_mesh_msg_ctx *ctx,
+			      struct net_buf_simple *buf)
 {
 	BT_DBG("src 0x%04x", ctx->addr);
 
 	hb_pub_send_status(model, ctx, STATUS_SUCCESS, NULL);
 }
 
-static void hearbeat_pub_set(struct bt_mesh_model *model,
-			     struct bt_mesh_msg_ctx *ctx,
-			     struct net_buf_simple *buf)
+static void heartbeat_pub_set(struct bt_mesh_model *model,
+			      struct bt_mesh_msg_ctx *ctx,
+			      struct net_buf_simple *buf)
 {
 	struct hb_pub_param *param = (void *)buf->data;
 	struct bt_mesh_cfg *cfg = model->user_data;
@@ -2725,7 +2738,7 @@ static void hearbeat_pub_set(struct bt_mesh_model *model,
 		 * as possible after the Heartbeat Publication Period state
 		 * has been configured for periodic publishing.
 		 */
-		if (param->period_log) {
+		if (param->period_log && param->count_log) {
 			k_work_submit(&cfg->hb_pub.timer.work);
 		} else {
 			k_delayed_work_cancel(&cfg->hb_pub.timer);
@@ -2772,18 +2785,18 @@ static void hb_sub_send_status(struct bt_mesh_model *model,
 	bt_mesh_model_send(model, ctx, msg, NULL, NULL);
 }
 
-static void hearbeat_sub_get(struct bt_mesh_model *model,
-			     struct bt_mesh_msg_ctx *ctx,
-			     struct net_buf_simple *buf)
+static void heartbeat_sub_get(struct bt_mesh_model *model,
+			      struct bt_mesh_msg_ctx *ctx,
+			      struct net_buf_simple *buf)
 {
 	BT_DBG("src 0x%04x", ctx->addr);
 
 	hb_sub_send_status(model, ctx, STATUS_SUCCESS);
 }
 
-static void hearbeat_sub_set(struct bt_mesh_model *model,
-			     struct bt_mesh_msg_ctx *ctx,
-			     struct net_buf_simple *buf)
+static void heartbeat_sub_set(struct bt_mesh_model *model,
+			      struct bt_mesh_msg_ctx *ctx,
+			      struct net_buf_simple *buf)
 {
 	struct bt_mesh_cfg *cfg = model->user_data;
 	u16_t sub_src, sub_dst;
@@ -2820,21 +2833,25 @@ static void hearbeat_sub_set(struct bt_mesh_model *model,
 	    sub_period == 0x00) {
 		cfg->hb_sub.src = BT_MESH_ADDR_UNASSIGNED;
 		cfg->hb_sub.dst = BT_MESH_ADDR_UNASSIGNED;
+		cfg->hb_sub.min_hops = 0;
+		cfg->hb_sub.max_hops = 0;
 		period_ms = 0;
 	} else {
 		cfg->hb_sub.src = sub_src;
 		cfg->hb_sub.dst = sub_dst;
+		cfg->hb_sub.min_hops = 0x7f;
+		cfg->hb_sub.max_hops = 0;
 		period_ms = hb_pwr2(sub_period, 1) * 1000;
 	}
 
 	BT_DBG("period_ms %u", period_ms);
 
 	cfg->hb_sub.count = 0;
-	cfg->hb_sub.min_hops = 0x7f;
-	cfg->hb_sub.max_hops = 0;
 
 	if (period_ms) {
 		cfg->hb_sub.expiry = k_uptime_get() + period_ms;
+	} else {
+		cfg->hb_sub.expiry = 0;
 	}
 
 	hb_sub_send_status(model, ctx, STATUS_SUCCESS);
@@ -2884,10 +2901,10 @@ const struct bt_mesh_model_op bt_mesh_cfg_op[] = {
 	{ OP_LPN_TIMEOUT_GET,          2,   lpn_timeout_get },
 	{ OP_KRP_GET,                  2,   krp_get },
 	{ OP_KRP_SET,                  3,   krp_set },
-	{ OP_HEARTBEAT_PUB_GET,        0,   hearbeat_pub_get },
-	{ OP_HEARTBEAT_PUB_SET,        9,   hearbeat_pub_set },
-	{ OP_HEARTBEAT_SUB_GET,        0,   hearbeat_sub_get },
-	{ OP_HEARTBEAT_SUB_SET,        5,   hearbeat_sub_set },
+	{ OP_HEARTBEAT_PUB_GET,        0,   heartbeat_pub_get },
+	{ OP_HEARTBEAT_PUB_SET,        9,   heartbeat_pub_set },
+	{ OP_HEARTBEAT_SUB_GET,        0,   heartbeat_sub_get },
+	{ OP_HEARTBEAT_SUB_SET,        5,   heartbeat_sub_set },
 	BT_MESH_MODEL_OP_END,
 };
 
@@ -2899,7 +2916,7 @@ static void hb_publish(struct k_work *work)
 	struct bt_mesh_subnet *sub;
 	u16_t period_ms;
 
-	BT_DBG("");
+	BT_DBG("hb_pub.count: %u", cfg->hb_pub.count);
 
 	sub = bt_mesh_subnet_get(cfg->hb_pub.net_idx);
 	if (!sub) {
@@ -2911,6 +2928,10 @@ static void hb_publish(struct k_work *work)
 
 	hb_send(model);
 
+	if (cfg->hb_pub.count == 0) {
+		return;
+	}
+
 	if (cfg->hb_pub.count != 0xffff) {
 		cfg->hb_pub.count--;
 	}
@@ -2960,7 +2981,7 @@ int bt_mesh_conf_init(struct bt_mesh_model *model, bool primary)
 	}
 
 	if (!IS_ENABLED(CONFIG_BT_MESH_FRIEND)) {
-		cfg->frnd = BT_MESH_RELAY_NOT_SUPPORTED;
+		cfg->frnd = BT_MESH_FRIEND_NOT_SUPPORTED;
 	}
 
 	if (!IS_ENABLED(CONFIG_BT_MESH_GATT_PROXY)) {

subsys/bluetooth/host/mesh/foundation.h

@@ -66,7 +66,7 @@
 #define OP_HEALTH_FAULT_TEST               BT_MESH_MODEL_OP_2(0x80, 0x32)
 #define OP_HEALTH_FAULT_TEST_UNREL         BT_MESH_MODEL_OP_2(0x80, 0x33)
 #define OP_HEALTH_PERIOD_GET               BT_MESH_MODEL_OP_2(0x80, 0x34)
-#define OP_HEALTH_PERIOD_SET               BT_MESH_MODEL_OP_2(0x80, 0x34)
+#define OP_HEALTH_PERIOD_SET               BT_MESH_MODEL_OP_2(0x80, 0x35)
 #define OP_HEALTH_PERIOD_SET_UNREL         BT_MESH_MODEL_OP_2(0x80, 0x36)
 #define OP_HEALTH_PERIOD_STATUS            BT_MESH_MODEL_OP_2(0x80, 0x37)
 #define OP_HEARTBEAT_PUB_GET               BT_MESH_MODEL_OP_2(0x80, 0x38)

subsys/bluetooth/host/mesh/health.c

@@ -79,6 +79,7 @@ static size_t health_get_current(struct bt_mesh_model *mod,
 				 struct net_buf_simple *msg)
 {
 	struct bt_mesh_health *srv = mod->user_data;
+	const struct bt_mesh_comp *comp;
 	u8_t *test_id, *company_ptr;
 	u16_t company_id;
 	u8_t fault_count;
@@ -88,6 +89,7 @@ static size_t health_get_current(struct bt_mesh_model *mod,
 
 	test_id = net_buf_simple_add(msg, 1);
 	company_ptr = net_buf_simple_add(msg, sizeof(company_id));
+	comp = bt_mesh_comp_get();
 
 	fault_count = net_buf_simple_tailroom(msg) - 4;
 
@@ -97,16 +99,17 @@ static size_t health_get_current(struct bt_mesh_model *mod,
 					 &fault_count);
 		if (err) {
 			BT_ERR("Failed to get faults (err %d)", err);
-			sys_put_le16(0, company_ptr);
+			sys_put_le16(comp->cid, company_ptr);
 			*test_id = HEALTH_TEST_STANDARD;
 			fault_count = 0;
 		} else {
 			sys_put_le16(company_id, company_ptr);
+			net_buf_simple_add(msg, fault_count);
 		}
 	} else {
 		BT_WARN("No callback for getting faults");
-		net_buf_simple_push_u8(msg, HEALTH_TEST_STANDARD);
-		net_buf_simple_push_le16(msg, 0);
+		sys_put_le16(comp->cid, company_ptr);
+		*test_id = HEALTH_TEST_STANDARD;
 		fault_count = 0;
 	}
 
@@ -213,7 +216,13 @@ static void health_fault_test(struct bt_mesh_model *model,
 	BT_DBG("test 0x%02x company 0x%04x", test_id, company_id);
 
 	if (srv->fault_test) {
-		srv->fault_test(model, test_id, company_id);
+		int err;
+
+		err = srv->fault_test(model, test_id, company_id);
+		if (err) {
+			BT_WARN("Running fault test failed with err %d", err);
+			return;
+		}
 	}
 
 	health_get_registered(model, company_id, msg);
@@ -279,11 +288,10 @@ static void send_health_period_status(struct bt_mesh_model *model,
 {
 	/* Needed size: opcode (2 bytes) + msg + MIC */
 	struct net_buf_simple *msg = NET_BUF_SIMPLE(2 + 1 + 4);
-	struct bt_mesh_health *srv = model->user_data;
 
 	bt_mesh_model_msg_init(msg, OP_HEALTH_PERIOD_STATUS);
 
-	net_buf_simple_add_u8(msg, srv->period);
+	net_buf_simple_add_u8(msg, model->pub->period_div);
 
 	bt_mesh_model_send(model, ctx, msg, NULL, NULL);
 }
@@ -301,7 +309,6 @@ static void health_period_set_unrel(struct bt_mesh_model *model,
 				    struct bt_mesh_msg_ctx *ctx,
 				    struct net_buf_simple *buf)
 {
-	struct bt_mesh_health *srv = model->user_data;
 	u8_t period;
 
 	period = net_buf_simple_pull_u8(buf);
@@ -312,7 +319,7 @@ static void health_period_set_unrel(struct bt_mesh_model *model,
 
 	BT_DBG("period %u", period);
 
-	srv->period = period;
+	model->pub->period_div = period;
 }
 
 static void health_period_set(struct bt_mesh_model *model,
@@ -344,16 +351,13 @@ const struct bt_mesh_model_op bt_mesh_health_op[] = {
 static void health_pub(struct bt_mesh_model *mod)
 {
 	struct net_buf_simple *msg = NET_BUF_SIMPLE(HEALTH_STATUS_SIZE);
-	struct bt_mesh_health *srv = mod->user_data;
 	size_t count;
 	int err;
 
 	BT_DBG("");
 
 	count = health_get_current(mod, msg);
-	if (count) {
-		mod->pub->period_div = srv->period;
-	} else {
+	if (!count) {
 		mod->pub->period_div = 0;
 	}
 

subsys/bluetooth/host/mesh/mesh.h

@@ -12,6 +12,7 @@
 #define BT_MESH_ADDR_IS_UNICAST(addr) ((addr) && (addr) < 0x8000)
 #define BT_MESH_ADDR_IS_GROUP(addr) ((addr) >= 0xc000 && (addr) <= 0xff00)
 #define BT_MESH_ADDR_IS_VIRTUAL(addr) ((addr) >= 0x8000 && (addr) < 0xc000)
+#define BT_MESH_ADDR_IS_RFU(addr) ((addr) >= 0xff00 && (addr) <= 0xfffb)
 
 struct bt_mesh_net;
 

subsys/bluetooth/host/mesh/net.c

@@ -68,6 +68,7 @@ static u16_t msg_cache_next;
 
 /* Singleton network context (the implementation only supports one) */
 struct bt_mesh_net bt_mesh = {
+	.local_queue = _K_FIFO_INITIALIZER(bt_mesh.local_queue),
 	.sub = {
 		[0 ... (CONFIG_BT_MESH_SUBNET_COUNT - 1)] = {
 			.net_idx = BT_MESH_KEY_UNUSED,
@@ -470,6 +471,26 @@ int bt_mesh_net_create(u16_t idx, u8_t flags, const u8_t key[16],
 	return 0;
 }
 
+void bt_mesh_net_revoke_keys(struct bt_mesh_subnet *sub)
+{
+	int i;
+
+	BT_DBG("idx 0x%04x", sub->net_idx);
+
+	memcpy(&sub->keys[0], &sub->keys[1], sizeof(sub->keys[0]));
+
+	for (i = 0; i < ARRAY_SIZE(bt_mesh.app_keys); i++) {
+		struct bt_mesh_app_key *key = &bt_mesh.app_keys[i];
+
+		if (key->net_idx != sub->net_idx || !key->updated) {
+			continue;
+		}
+
+		memcpy(&key->keys[0], &key->keys[1], sizeof(key->keys[0]));
+		key->updated = false;
+	}
+}
+
 bool bt_mesh_kr_update(struct bt_mesh_subnet *sub, u8_t new_kr, bool new_key)
 {
 	if (new_kr != sub->kr_flag && sub->kr_phase == BT_MESH_KR_NORMAL) {
@@ -501,8 +522,7 @@ bool bt_mesh_kr_update(struct bt_mesh_subnet *sub, u8_t new_kr, bool new_key)
 		 */
 		case BT_MESH_KR_PHASE_2:
 			BT_DBG("KR Phase 0x%02x -> Normal", sub->kr_phase);
-			memcpy(&sub->keys[0], &sub->keys[1],
-			       sizeof(sub->keys[0]));
+			bt_mesh_net_revoke_keys(sub);
 			if (IS_ENABLED(CONFIG_BT_MESH_LOW_POWER) ||
 			    IS_ENABLED(CONFIG_BT_MESH_FRIEND)) {
 				bt_mesh_friend_cred_refresh(sub->net_idx);
@@ -677,7 +697,6 @@ int bt_mesh_net_resend(struct bt_mesh_subnet *sub, struct net_buf *buf,
 	return 0;
 }
 
-#if defined(CONFIG_BT_MESH_LOCAL_INTERFACE)
 static void bt_mesh_net_local(struct k_work *work)
 {
 	struct net_buf *buf;
@@ -688,7 +707,6 @@ static void bt_mesh_net_local(struct k_work *work)
 		net_buf_unref(buf);
 	}
 }
-#endif
 
 int bt_mesh_net_encode(struct bt_mesh_net_tx *tx, struct net_buf_simple *buf,
 		       bool proxy)
@@ -801,7 +819,6 @@ int bt_mesh_net_send(struct bt_mesh_net_tx *tx, struct net_buf *buf,
 		}
 	}
 
-#if defined(CONFIG_BT_MESH_LOCAL_INTERFACE)
 	/* Deliver to local network interface if necessary */
 	if (bt_mesh_fixed_group_match(tx->ctx->addr) ||
 	    bt_mesh_elem_find(tx->ctx->addr)) {
@@ -813,9 +830,6 @@ int bt_mesh_net_send(struct bt_mesh_net_tx *tx, struct net_buf *buf,
 	} else {
 		bt_mesh_adv_send(buf, cb);
 	}
-#else
-	bt_mesh_adv_send(buf, cb);
-#endif
 
 done:
 	net_buf_unref(buf);
@@ -975,9 +989,6 @@ static int net_find_and_decrypt(const u8_t *data, size_t data_len,
 	return false;
 }
 
-#if (defined(CONFIG_BT_MESH_RELAY) || \
-     defined(CONFIG_BT_MESH_FRIEND) || \
-     defined(CONFIG_BT_MESH_GATT_PROXY))
 static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
 			      struct bt_mesh_net_rx *rx)
 {
@@ -988,7 +999,7 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
 	BT_DBG("TTL %u CTL %u dst 0x%04x", rx->ctx.recv_ttl, CTL(sbuf->data),
 	       rx->dst);
 
-	if (rx->ctx.recv_ttl <= 1) {
+	if (rx->net_if != BT_MESH_NET_IF_LOCAL && rx->ctx.recv_ttl <= 1) {
 		return;
 	}
 
@@ -1081,7 +1092,6 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
 done:
 	net_buf_unref(buf);
 }
-#endif /* RELAY || FRIEND || GATT_PROXY */
 
 int bt_mesh_net_decode(struct net_buf_simple *data, enum bt_mesh_net_if net_if,
 		       struct bt_mesh_net_rx *rx, struct net_buf_simple *buf,
@@ -1135,6 +1145,17 @@ int bt_mesh_net_decode(struct net_buf_simple *data, enum bt_mesh_net_if net_if,
 
 	BT_DBG("Decryption successful. Payload len %u", buf->len);
 
+	if (net_if != BT_MESH_NET_IF_PROXY_CFG &&
+	    rx->dst == BT_MESH_ADDR_UNASSIGNED) {
+		BT_ERR("Destination address is unassigned; dropping packet");
+		return -EBADMSG;
+	}
+
+	if (BT_MESH_ADDR_IS_RFU(rx->dst)) {
+		BT_ERR("Destination address is RFU; dropping packet");
+		return -EBADMSG;
+	}
+
 	if (net_if != BT_MESH_NET_IF_LOCAL && bt_mesh_elem_find(rx->ctx.addr)) {
 		BT_DBG("Dropping locally originated packet");
 		return -EBADMSG;
@@ -1181,12 +1202,8 @@ void bt_mesh_net_recv(struct net_buf_simple *data, s8_t rssi,
 		}
 	}
 
-#if (defined(CONFIG_BT_MESH_RELAY) || \
-     defined(CONFIG_BT_MESH_FRIEND) || \
-     defined(CONFIG_BT_MESH_GATT_PROXY))
 	net_buf_simple_restore(buf, &state);
 	bt_mesh_net_relay(buf, &rx);
-#endif /* CONFIG_BT_MESH_RELAY  || FRIEND || GATT_PROXY */
 }
 
 static void ivu_complete(struct k_work *work)
@@ -1201,7 +1218,5 @@ void bt_mesh_net_init(void)
 {
 	k_delayed_work_init(&bt_mesh.ivu_complete, ivu_complete);
 
-#if defined(CONFIG_BT_MESH_LOCAL_INTERFACE)
 	k_work_init(&bt_mesh.local_work, bt_mesh_net_local);
-#endif
 }

subsys/bluetooth/host/mesh/net.h

@@ -166,11 +166,9 @@ struct bt_mesh_net {
 
 	s64_t last_update;       /* Time since last IV Update change */
 
-#if defined(CONFIG_BT_MESH_LOCAL_INTERFACE)
 	/* Local network interface */
 	struct k_work local_work;
 	struct k_fifo local_queue;
-#endif
 
 #if defined(CONFIG_BT_MESH_FRIEND)
 	struct bt_mesh_friend frnd;  /* Friend state */
@@ -247,6 +245,8 @@ int bt_mesh_friend_cred_del(u16_t net_idx, u16_t addr);
 
 bool bt_mesh_kr_update(struct bt_mesh_subnet *sub, u8_t new_kr, bool new_key);
 
+void bt_mesh_net_revoke_keys(struct bt_mesh_subnet *sub);
+
 int bt_mesh_net_beacon_update(struct bt_mesh_subnet *sub);
 
 void bt_mesh_rpl_reset(void);

subsys/bluetooth/host/mesh/prov.c

@@ -150,6 +150,9 @@ struct prov_link {
 		/* Start timestamp of the transaction */
 		s64_t start;
 
+		/* Transaction id*/
+		u8_t id;
+
 		/* Pending outgoing buffer(s) */
 		struct net_buf *buf[3];
 
@@ -358,11 +361,21 @@ static u8_t last_seg(u8_t len)
 	return 1 + (len / CONT_PAYLOAD_MAX);
 }
 
+static inline u8_t next_transaction_id(void)
+{
+	if (link.tx.id != 0 && link.tx.id != 0xFF) {
+		return ++link.tx.id;
+	}
+
+	link.tx.id = 0x80;
+	return link.tx.id;
+}
+
 static int prov_send_adv(struct net_buf_simple *msg)
 {
-	static u8_t id = 0x80;
 	struct net_buf *start, *buf;
 	u8_t seg_len, seg_id;
+	u8_t xact_id;
 
 	BT_DBG("len %u: %s", msg->len, bt_hex(msg->data, msg->len));
 
@@ -373,8 +386,9 @@ static int prov_send_adv(struct net_buf_simple *msg)
 		return -ENOBUFS;
 	}
 
+	xact_id = next_transaction_id();
 	net_buf_add_be32(start, link.id);
-	net_buf_add_u8(start, id);
+	net_buf_add_u8(start, xact_id);
 
 	net_buf_add_u8(start, GPC_START(last_seg(msg->len)));
 	net_buf_add_be16(start, msg->len);
@@ -409,14 +423,12 @@ static int prov_send_adv(struct net_buf_simple *msg)
 		       bt_hex(msg->data, seg_len));
 
 		net_buf_add_be32(buf, link.id);
-		net_buf_add_u8(buf, id);
+		net_buf_add_u8(buf, xact_id);
 		net_buf_add_u8(buf, GPC_CONT(seg_id));
 		net_buf_add_mem(buf, msg->data, seg_len);
 		net_buf_simple_pull(msg, seg_len);
 	}
 
-	id++;
-
 	send_reliable();
 
 	return 0;
@@ -455,6 +467,15 @@ static void prov_buf_init(struct net_buf_simple *buf, u8_t type)
 	net_buf_simple_add_u8(buf, type);
 }
 
+static void prov_send_fail_msg(u8_t err)
+{
+	struct net_buf_simple *buf = PROV_BUF(2);
+
+	prov_buf_init(buf, PROV_FAILED);
+	net_buf_simple_add_u8(buf, err);
+	prov_send(buf);
+}
+
 static void prov_invite(const u8_t *data)
 {
 	struct net_buf_simple *buf = PROV_BUF(12);
@@ -596,7 +617,8 @@ static int prov_auth(u8_t method, u8_t action, u8_t size)
 		}
 
 		if (output == BT_MESH_DISPLAY_STRING) {
-			u8_t i, str[9];
+			char str[9];
+			u8_t i;
 
 			bt_rand(str, size);
 
@@ -664,6 +686,13 @@ static void prov_start(const u8_t *data)
 
 	if (data[0] != PROV_ALG_P256) {
 		BT_ERR("Unknown algorithm 0x%02x", data[0]);
+		prov_send_fail_msg(PROV_ERR_NVAL_FMT);
+		return;
+	}
+
+	if (data[1] > 0x01) {
+		BT_ERR("Invalid public key value: 0x%02x", data[1]);
+		prov_send_fail_msg(PROV_ERR_NVAL_FMT);
 		return;
 	}
 
@@ -672,7 +701,9 @@ static void prov_start(const u8_t *data)
 	link.expect = PROV_PUB_KEY;
 
 	if (prov_auth(data[2], data[3], data[4]) < 0) {
-		BT_ERR("Invalid authentication method");
+		BT_ERR("Invalid authentication method: 0x%02x; "
+			"action: 0x%02x; size: 0x%02x", data[2], data[3], data[4]);
+		prov_send_fail_msg(PROV_ERR_NVAL_FMT);
 	}
 }
 
@@ -1035,11 +1066,7 @@ static void close_link(u8_t err, u8_t reason)
 
 #if defined(CONFIG_BT_MESH_PB_ADV)
 	if (err) {
-		struct net_buf_simple *buf = PROV_BUF(2);
-
-		prov_buf_init(buf, PROV_FAILED);
-		net_buf_simple_add_u8(buf, err);
-		prov_send(buf);
+		prov_send_fail_msg(err);
 	}
 
 	link.rx.seg = 0;
@@ -1168,11 +1195,6 @@ static void prov_msg_recv(void)
 
 	BT_DBG("type 0x%02x len %u", type, link.rx.buf->len);
 
-	if (type != PROV_FAILED && type != link.expect) {
-		BT_WARN("Unexpected msg 0x%02x != 0x%02x", type, link.expect);
-		return;
-	}
-
 	if (!bt_mesh_fcs_check(link.rx.buf, link.rx.fcs)) {
 		BT_ERR("Incorrect FCS");
 		return;
@@ -1182,6 +1204,12 @@ static void prov_msg_recv(void)
 	link.rx.prev_id = link.rx.id;
 	link.rx.id = 0;
 
+	if (type != PROV_FAILED && type != link.expect) {
+		BT_WARN("Unexpected msg 0x%02x != 0x%02x", type, link.expect);
+		prov_send_fail_msg(PROV_ERR_UNEXP_PDU);
+		return;
+	}
+
 	if (type >= ARRAY_SIZE(prov_handlers)) {
 		BT_ERR("Unknown provisioning PDU type 0x%02x", type);
 		close_link(PROV_ERR_NVAL_PDU, CLOSE_REASON_FAILED);
@@ -1249,6 +1277,14 @@ static void gen_prov_cont(struct prov_rx *rx, struct net_buf_simple *buf)
 static void gen_prov_ack(struct prov_rx *rx, struct net_buf_simple *buf)
 {
 	BT_DBG("len %u", buf->len);
+
+	if (!link.tx.buf[0]) {
+		return;
+	}
+
+	if (rx->xact_id == link.tx.id) {
+		prov_clear_tx();
+	}
 }
 
 static void gen_prov_start(struct prov_rx *rx, struct net_buf_simple *buf)

subsys/bluetooth/host/mesh/transport.c

@@ -529,6 +529,7 @@ static int sdu_recv(struct bt_mesh_net_rx *rx, u8_t hdr, u8_t mic_size,
 		}
 
 		bt_mesh_model_recv(rx, sdu);
+		return 0;
 	}
 
 	BT_WARN("No matching AppKey");
@@ -979,7 +980,7 @@ static int trans_seg(struct net_buf_simple *buf, struct bt_mesh_net_rx *net_rx)
 	}
 
 	/* Bail out early if we're not ready to receive such a large SDU */
-	if (!sdu_len_is_ok(&net_rx->ctx, seg_n)) {
+	if (!sdu_len_is_ok(net_rx->ctl, seg_n)) {
 		BT_ERR("Too big incoming SDU length");
 		send_ack(net_rx->sub, net_rx->dst, net_rx->ctx.addr,
 			 net_rx->ctx.send_ttl, seq_zero, 0);

subsys/net/lib/dns/resolve.c

@@ -287,11 +287,20 @@ static int dns_read(struct dns_resolve_context *ctx,
 		info->ai_addr.sa_family = AF_INET;
 		info->ai_addrlen = sizeof(struct sockaddr_in);
 	} else if (ctx->queries[query_idx].query_type == DNS_QUERY_TYPE_AAAA) {
+		/* We cannot resolve IPv6 address if IPv6 is disabled. The reason
+		 * being that "struct sockaddr" does not have enough space for
+		 * IPv6 address in that case.
+		 */
+#if defined(CONFIG_NET_IPV6)
 		address_size = DNS_IPV6_LEN;
 		addr = (u8_t *)&net_sin6(&info->ai_addr)->sin6_addr;
 		info->ai_family = AF_INET6;
 		info->ai_addr.sa_family = AF_INET6;
 		info->ai_addrlen = sizeof(struct sockaddr_in6);
+#else
+		ret = DNS_EAI_FAMILY;
+		goto quit;
+#endif
 	} else {
 		ret = DNS_EAI_FAMILY;
 		goto quit;
@@ -608,10 +617,10 @@ int dns_resolve_name(struct dns_resolve_context *ctx,
 		     void *user_data,
 		     s32_t timeout)
 {
-	struct net_buf *dns_data;
+	struct net_buf *dns_data = NULL;
 	struct net_buf *dns_qname = NULL;
 	struct sockaddr addr;
-	int ret, i, j = 0;
+	int ret, i = -1, j = 0;
 	int failure = 0;
 
 	if (!ctx || !ctx->is_used || !query || !cb) {
@@ -638,11 +647,16 @@ int dns_resolve_name(struct dns_resolve_context *ctx,
 			info.ai_addr.sa_family = AF_INET;
 			info.ai_addrlen = sizeof(struct sockaddr_in);
 		} else if (type == DNS_QUERY_TYPE_AAAA) {
+#if defined(CONFIG_NET_IPV6)
 			memcpy(net_sin6(&info.ai_addr), net_sin6(&addr),
 			       sizeof(struct sockaddr_in6));
 			info.ai_family = AF_INET6;
 			info.ai_addr.sa_family = AF_INET6;
 			info.ai_addrlen = sizeof(struct sockaddr_in6);
+#else
+			ret = -EAFNOSUPPORT;
+			goto quit;
+#endif
 		} else {
 			goto try_resolve;
 		}
@@ -729,11 +743,14 @@ try_resolve:
 
 quit:
 	if (ret < 0) {
-		if (k_delayed_work_remaining_get(&ctx->queries[i].timer) > 0) {
-			k_delayed_work_cancel(&ctx->queries[i].timer);
-		}
+		if (i >= 0) {
+			if (k_delayed_work_remaining_get(
+				    &ctx->queries[i].timer) > 0) {
+				k_delayed_work_cancel(&ctx->queries[i].timer);
+			}
 
-		ctx->queries[i].cb = NULL;
+			ctx->queries[i].cb = NULL;
+		}
 
 		if (dns_id) {
 			*dns_id = 0;

tests/bluetooth/tester/Makefile

@@ -13,7 +13,7 @@ BOARD ?= arduino_101
 CONF_FILE ?= default.conf
 
 # UART for Tester
-QEMU_EXTRA_FLAGS = -serial pipe:/tmp/bt-stack-tester
+QEMU_EXTRA_FLAGS = -serial unix:/tmp/bt-stack-tester
 
 # UART for Bluetooth
 QEMU_EXTRA_FLAGS += -serial unix:/tmp/bt-server-bredr

tests/kernel/fifo/fifo_api/prj_poll.conf

@@ -0,0 +1,3 @@
+CONFIG_ZTEST=y
+CONFIG_IRQ_OFFLOAD=y
+CONFIG_POLL=y

tests/kernel/fifo/fifo_api/testcase.yaml

@@ -1,3 +1,6 @@
 tests:
--   test:
-        tags: kernel
+  - test:
+      tags: kernel
+  - test_poll:
+      extra_args: CONF_FILE="prj_poll.conf"
+      tags: kernel

tests/kernel/mem_pool/mem_pool_api/prj.conf

@@ -1,4 +1,2 @@
 CONFIG_ZTEST=y
 CONFIG_IRQ_OFFLOAD=y
-CONFIG_MAIN_STACK_SIZE=1024
-CONFIG_ISR_STACK_SIZE=512

tests/lib/json/testcase.yaml

@@ -1,5 +1,4 @@
 tests:
 -   test:
-        build_only: true
         filter: not CONFIG_NEWLIB_LIBC
         tags: json

tests/net/lib/dns_resolve/prj-no-ipv6.conf

@@ -0,0 +1,31 @@
+CONFIG_NETWORKING=y
+CONFIG_NET_TEST=y
+CONFIG_RANDOM_GENERATOR=y
+CONFIG_TEST_RANDOM_GENERATOR=y
+
+CONFIG_NET_L2_DUMMY=y
+
+CONFIG_DNS_RESOLVER=y
+CONFIG_DNS_RESOLVER_MAX_SERVERS=2
+CONFIG_DNS_NUM_OF_CONCUR_QUERIES=1
+
+CONFIG_DNS_SERVER_IP_ADDRESSES=y
+CONFIG_DNS_SERVER1="192.0.2.2"
+CONFIG_DNS_SERVER2="192.0.2.2:5353"
+
+CONFIG_NET_LOG=y
+CONFIG_SYS_LOG_NET_LEVEL=2
+CONFIG_SYS_LOG_SHOW_COLOR=y
+#CONFIG_NET_DEBUG_DNS_RESOLVE=y
+
+CONFIG_NET_IPV4=y
+CONFIG_NET_IPV6=n
+CONFIG_NET_IPV6_DAD=n
+CONFIG_NET_IPV6_MLD=n
+CONFIG_NET_IPV6_ND=n
+CONFIG_NET_ARP=n
+
+CONFIG_PRINTK=y
+CONFIG_ZTEST=y
+
+CONFIG_MAIN_STACK_SIZE=1344

tests/net/lib/dns_resolve/src/main.c

@@ -374,10 +374,12 @@ static void dns_query_ipv4_server_count(void)
 			continue;
 		}
 
-		if (ctx->servers[i].dns_server.sa_family == AF_INET) {
-			count++;
+		if (ctx->servers[i].dns_server.sa_family == AF_INET6) {
+			continue;
 		}
 
+		count++;
+
 		if (net_sin(&ctx->servers[i].dns_server)->sin_port ==
 		    ntohs(53)) {
 			port++;
@@ -385,7 +387,7 @@ static void dns_query_ipv4_server_count(void)
 	}
 
 	zassert_equal(count, 2, "Invalid number of IPv4 servers");
-	zassert_equal(port, 2, "Invalid number of IPv4 servers with port 53");
+	zassert_equal(port, 1, "Invalid number of IPv4 servers with port 53");
 }
 
 static void dns_query_ipv6_server_count(void)
@@ -402,18 +404,25 @@ static void dns_query_ipv6_server_count(void)
 			continue;
 		}
 
-		if (ctx->servers[i].dns_server.sa_family == AF_INET6) {
-			count++;
+		if (ctx->servers[i].dns_server.sa_family == AF_INET) {
+			continue;
 		}
 
+		count++;
+
 		if (net_sin6(&ctx->servers[i].dns_server)->sin6_port ==
 		    ntohs(53)) {
 			port++;
 		}
 	}
 
+#if defined(CONFIG_NET_IPV6)
 	zassert_equal(count, 2, "Invalid number of IPv6 servers");
-	zassert_equal(port, 2, "Invalid number of IPv6 servers with port 53");
+	zassert_equal(port, 1, "Invalid number of IPv6 servers with port 53");
+#else
+	zassert_equal(count, 0, "Invalid number of IPv6 servers");
+	zassert_equal(port, 0, "Invalid number of IPv6 servers with port 53");
+#endif
 }
 
 static void dns_query_too_many(void)
@@ -671,10 +680,12 @@ void dns_result_numeric_cb(enum dns_resolve_status status,
 	}
 
 	if (info && info->ai_family == AF_INET6) {
+#if defined(CONFIG_NET_IPV6)
 		if (net_ipv6_addr_cmp(&net_sin6(&info->ai_addr)->sin6_addr,
 				      &my_addr3) != true) {
 			zassert_true(false, "IPv6 address does not match");
 		}
+#endif
 	}
 
 	k_sem_give(&wait_data2);

tests/net/lib/dns_resolve/testcase.yaml

@@ -3,3 +3,8 @@ tests:
         tags: dns net
         min_ram: 16
         timeout: 600
+-   test-no-ipv6:
+        tags: dns net
+        min_ram: 16
+        timeout: 600
+        extra_args: CONF_FILE=prj-no-ipv6.conf