release: Zephyr 2.4.0

Set version to 2.4.0.

Signed-off-by: Maureen Helm <maureen.helm@nxp.com>

.buildkite/daily.yml

@@ -4,7 +4,7 @@ steps:
     env:
       ZEPHYR_TOOLCHAIN_VARIANT: "zephyr"
       ZEPHYR_SDK_INSTALL_DIR: "/opt/sdk/zephyr-sdk-0.11.3"
-    parallelism: 120
+    parallelism: 240
     timeout_in_minutes: 210
     retry:
       manual: true

.github/workflows/stale_issue.yml

@@ -16,6 +16,6 @@ jobs:
         days-before-close: 14
         stale-issue-label: 'Stale'
         stale-pr-label: 'Stale'
-        exempt-pr-labels: 'DNM,In progress'
+        exempt-pr-labels: 'Blocked,In progress'
         exempt-issue-labels: 'In progress,Enhancement,Feature,Feature Request,RFC,Meta'
-        operations-per-run: 100
+        operations-per-run: 400

CODEOWNERS

@@ -145,6 +145,7 @@
 /doc/reference/devicetree/                @galak @mbolivar-nordic
 /doc/reference/resource_management/       @pabigot
 /doc/reference/networking/can*            @alexanderwachter
+/doc/security/                            @ceolin @d3zd3z
 /drivers/debug/                           @nashif
 /drivers/*/*cc13xx_cc26xx*                @bwitherspoon
 /drivers/*/*mcux*                         @MaureenHelm

VERSION

@@ -2,4 +2,4 @@ VERSION_MAJOR = 2
 VERSION_MINOR = 4
 PATCHLEVEL = 0
 VERSION_TWEAK = 0
-EXTRAVERSION = rc2
+EXTRAVERSION =

arch/arm/core/aarch32/cortex_m/Kconfig

@@ -139,6 +139,7 @@ config CPU_CORTEX_M_HAS_PROGRAMMABLE_FAULT_PRIOS
 
 config CPU_CORTEX_M0_HAS_VECTOR_TABLE_REMAP
 	bool
+	depends on ARMV6_M_ARMV8_M_BASELINE
 	help
 	  This option signifies the Cortex-M0 has some mechanisms that can map
 	  the vector table to SRAM
@@ -280,8 +281,8 @@ config SW_VECTOR_RELAY
 
 config SW_VECTOR_RELAY_CLIENT
 	bool "Enable Software Vector Relay (client)"
-	default y if BOOTLOADER_MCUBOOT
-	depends on ARMV6_M_ARMV8_M_BASELINE && !(CPU_CORTEX_M0_HAS_VECTOR_TABLE_REMAP || CPU_CORTEX_M_HAS_VTOR)
+	default y if BOOTLOADER_MCUBOOT && !CPU_CORTEX_M0_HAS_VECTOR_TABLE_REMAP
+	depends on !CPU_CORTEX_M_HAS_VTOR
 	help
 	  Another image has enabled SW_VECTOR_RELAY, and will be forwarding
 	  exceptions and HW interrupts to this image. Enable this option to make

arch/arm/core/aarch32/cortex_m/tz/secure_entry_functions.ld

@@ -5,23 +5,27 @@
  */
 
 /* nRF-specific defines. */
-#ifdef CONFIG_CPU_HAS_NRF_IDAU
+#if defined(CONFIG_CPU_HAS_NRF_IDAU) && CONFIG_ARM_NSC_REGION_BASE_ADDRESS == 0
 	/* This SOC needs the NSC region to be at the end of an SPU region. */
+	#define __NSC_ALIGN (ALIGN(CONFIG_NRF_SPU_FLASH_REGION_SIZE) \
+			- MAX(32, (1 << LOG2CEIL(__sg_size))))
 	#define NSC_ALIGN \
-		. = ALIGN(CONFIG_NRF_SPU_FLASH_REGION_SIZE) \
-			- (1 << LOG2CEIL(__sg_size))
+		. =  (__NSC_ALIGN + ((ABSOLUTE(.) > __NSC_ALIGN) \
+				? CONFIG_NRF_SPU_FLASH_REGION_SIZE : 0))
 	#define NSC_ALIGN_END . = ALIGN(CONFIG_NRF_SPU_FLASH_REGION_SIZE)
-#endif /* CONFIG_CPU_HAS_NRF_IDAU */
-
+#endif /* CONFIG_CPU_HAS_NRF_IDAU && CONFIG_ARM_NSC_REGION_BASE_ADDRESS != 0 */
 
+#ifndef NSC_ALIGN
 #if CONFIG_ARM_NSC_REGION_BASE_ADDRESS != 0
 	#define NSC_ALIGN . = ABSOLUTE(CONFIG_ARM_NSC_REGION_BASE_ADDRESS)
-#elif !defined(NSC_ALIGN)
-	#define NSC_ALIGN . = ALIGN(4)
+#else
+	/* The ARM SAU requires regions to be 32-byte-aligned. */
+	#define NSC_ALIGN . = ALIGN(32)
 #endif /* CONFIG_ARM_NSC_REGION_BASE_ADDRESS */
+#endif /* !NSC_ALIGN */
 
 #ifndef NSC_ALIGN_END
-	#define NSC_ALIGN_END . = ALIGN(4)
+	#define NSC_ALIGN_END . = ALIGN(32)
 #endif
 
 SECTION_PROLOGUE(.gnu.sgstubs,,)

arch/x86/core/intel64/locore.S

@@ -324,17 +324,23 @@ z_x86_switch:
  */
 
 __resume:
-#ifdef CONFIG_USERSPACE
-#ifndef CONFIG_X86_KPTI
+#if (!defined(CONFIG_X86_KPTI) && defined(CONFIG_USERSPACE)) \
+		|| defined(CONFIG_TRACING)
+	pushq %rdi	/* Caller-saved, stash it */
+#if !defined(CONFIG_X86_KPTI) && defined(CONFIG_USERSPACE)
 	/* If KPTI is enabled we're always on the kernel's page tables in
 	 * this context and the appropriate page table switch takes place
 	 * when trampolining back to user mode
 	 */
-	pushq %rdi	/* Caller-saved, stash it */
 	call z_x86_swap_update_page_tables
+#endif
+#ifdef CONFIG_TRACING
+	call sys_trace_thread_switched_in
+#endif
 	popq %rdi
-#endif /* CONFIG_X86_KPTI */
+#endif /* (!CONFIG_X86_KPTI && CONFIG_USERSPACE) || CONFIG_TRACING */
 
+#ifdef CONFIG_USERSPACE
 	/* Set up exception return stack frame */
 	pushq _thread_offset_to_ss(%rdi)	/* SS */
 #else
@@ -402,7 +408,6 @@ __resume:
 	/* swapgs variant of Spectre V1. Disable speculation past this point */
 	lfence
 #endif /* CONFIG_X86_BOUNDS_CHECK_BYPASS_MITIGATION */
-
 	iretq
 
 

arch/x86/core/pcie.c

@@ -61,14 +61,6 @@ static void pcie_mm_init(void)
 static inline void pcie_mm_conf(pcie_bdf_t bdf, unsigned int reg,
 				bool write, uint32_t *data)
 {
-	if (bus_segs[0].mmio == NULL) {
-		pcie_mm_init();
-	}
-
-	if (do_pcie_mmio_cfg == false) {
-		return;
-	}
-
 	for (int i = 0; i < ARRAY_SIZE(bus_segs); i++) {
 		int off = PCIE_BDF_TO_BUS(bdf) - bus_segs[i].start_bus;
 
@@ -133,6 +125,10 @@ static inline void pcie_conf(pcie_bdf_t bdf, unsigned int reg,
 
 {
 #ifdef CONFIG_PCIE_MMIO_CFG
+	if (bus_segs[0].mmio == NULL) {
+		pcie_mm_init();
+	}
+
 	if (do_pcie_mmio_cfg) {
 		pcie_mm_conf(bdf, reg, write, data);
 	} else

arch/x86/core/x86_mmu.c

@@ -398,7 +398,7 @@ void z_x86_dump_page_tables(pentry_t *ptables)
 #if DUMP_PAGE_TABLES
 static int dump_kernel_tables(const struct device *unused)
 {
-	z_x86_dump_page_tables(&z_x86_kernel_ptables);
+	z_x86_dump_page_tables(z_x86_kernel_ptables);
 
 	return 0;
 }
@@ -626,7 +626,7 @@ int arch_mem_map(void *virt, uintptr_t phys, size_t size, uint32_t flags)
 	 * this for driver mappings. User mode mappings
 	 * (and interactions with KPTI) not implemented yet.
 	 */
-	ptables = (pentry_t *)&z_x86_kernel_ptables;
+	ptables = z_x86_kernel_ptables;
 
 	/* Translate flags argument into HW-recognized entry flags.
 	 *
@@ -697,7 +697,7 @@ static void stack_guard_set(void *guard_page)
 	/* Always modify the kernel's page tables since this is for
 	 * supervisor threads or handling syscalls
 	 */
-	ret = page_map_set(&z_x86_kernel_ptables, guard_page, pte,
+	ret = page_map_set(z_x86_kernel_ptables, guard_page, pte,
 			   page_pool_get, NULL);
 	/* Literally should never happen */
 	__ASSERT(ret == 0, "stack guard mapping failed for %p", guard_page);
@@ -858,7 +858,7 @@ static void thread_map(struct k_thread *thread, void *ptr, size_t size,
 /* Get the kernel's PTE value for a particular virtual address */
 static pentry_t kernel_page_map_get(void *virt)
 {
-	pentry_t *table = &z_x86_kernel_ptables;
+	pentry_t *table = z_x86_kernel_ptables;
 
 	for (int level = 0; level < NUM_LEVELS; level++) {
 		pentry_t entry = get_entry(table, virt, level);
@@ -961,7 +961,7 @@ static void setup_thread_tables(struct k_thread *thread,
 				pentry_t *thread_ptables)
 {
 	/* Copy top-level structure verbatim */
-	(void)memcpy(thread_ptables, &z_x86_kernel_ptables, table_size(0));
+	(void)memcpy(thread_ptables, &z_x86_kernel_ptables[0], table_size(0));
 
 	/* Proceed through linked structure levels, and for all system RAM
 	 * virtual addresses, create copies of all relevant tables.
@@ -985,7 +985,7 @@ static void setup_thread_tables(struct k_thread *thread,
 						  level - 1);
 
 			/* Master table contents, which we make a copy of */
-			master_table = page_table_get(&z_x86_kernel_ptables,
+			master_table = page_table_get(z_x86_kernel_ptables,
 						      virt, level);
 
 			/* Pulled out of reserved memory in the stack object */

arch/x86/include/x86_mmu.h

@@ -147,7 +147,7 @@ static inline pentry_t *z_x86_page_tables_get(void)
 /* Kernel's page table. This is in CR3 for all supervisor threads.
  * if KPTI is enabled, we switch to this when handling exceptions or syscalls
  */
-extern pentry_t z_x86_kernel_ptables;
+extern pentry_t z_x86_kernel_ptables[];
 
 /* Get the page tables used by this thread during normal execution */
 static inline pentry_t *z_x86_thread_page_tables_get(struct k_thread *thread)
@@ -155,7 +155,7 @@ static inline pentry_t *z_x86_thread_page_tables_get(struct k_thread *thread)
 #ifdef CONFIG_USERSPACE
 	return (pentry_t *)(thread->arch.ptables);
 #else
-	return &z_x86_kernel_ptables;
+	return z_x86_kernel_ptables;
 #endif
 }
 #endif /* ZEPHYR_ARCH_X86_INCLUDE_X86_MMU_H */

boards/arm/arty/doc/index.rst

@@ -133,6 +133,12 @@ or:
         pld load 0 m3_for_arty_a7_reference.bit;\
         shutdown"
 
+.. note::
+
+   The pre-built FPGA bitstream only works for Arty boards equipped with an
+   Artix-35T FPGA. For other Arty variants (e.g. the Arty A7-100) the bitstream
+   must be rebuilt.
+
 Next, build and flash applications as usual (see :ref:`build_an_application` and
 :ref:`application_run` for more details).
 

boards/arm/atsamr21_xpro/atsamr21_xpro.yaml

@@ -1,4 +1,4 @@
-# Copyright (c) 2019 Gerson Fernando Budke
+# Copyright (c) 2019-2020 Gerson Fernando Budke
 # Copyright (c) 2019 Benjamin Valentin
 # SPDX-License-Identifier: Apache-2.0
 identifier: atsamr21_xpro
@@ -15,6 +15,7 @@ supported:
   - gpio
   - i2c
   - ieee802154
+  - netif
   - pwm
   - spi
   - usb_device

boards/arm/b_l4s5i_iot01a/b_l4s5i_iot01a.dts

@@ -22,11 +22,11 @@
 	leds {
 		compatible = "gpio-leds";
 		green_led_1: led_1 {
-			gpios = <&gpioa 5 GPIO_ACTIVE_LOW>;
+			gpios = <&gpioa 5 GPIO_ACTIVE_HIGH>;
 			label = "User LD1";
 		};
 		green_led_2: led_2 {
-			gpios = <&gpiob 14 GPIO_ACTIVE_LOW>;
+			gpios = <&gpiob 14 GPIO_ACTIVE_HIGH>;
 			label = "User LD2";
 		};
 	};

boards/arm/mps2_an521/CMakeLists.txt

@@ -59,6 +59,7 @@ if (CONFIG_BUILD_WITH_TFM)
 			 ${ADD_S_IMAGE_MIN_VER}
 			 ${ADD_SECURITY_COUNTER_NS}
 			 -H 0x400
+			 --included-header
 			 ${CMAKE_BINARY_DIR}/zephyr/${KERNEL_BIN_NAME}
 			 ${CMAKE_BINARY_DIR}/zephyr_ns_signed.bin
 

boards/arm/mps2_an521/mps2_an521_nonsecure.dts

@@ -77,8 +77,8 @@
 		reg = <0x28100000 0x100000>;
 	};
 
-	flash0: flash@100400 {
-		reg = <0x100400 0xDF00000>;
+	flash0: flash@100000 {
+		reg = <0x100000 0xDF00000>;
 	};
 
 	soc {

boards/arm/nucleo_l552ze_q/CMakeLists.txt

@@ -51,6 +51,7 @@ if (CONFIG_BUILD_WITH_TFM)
 			 ${ADD_S_IMAGE_MIN_VER}
 			 ${ADD_SECURITY_COUNTER_NS}
 			 -H 0x400
+			 --included-header
 			 ${CMAKE_BINARY_DIR}/zephyr/${KERNEL_BIN_NAME}
 			 ${CMAKE_BINARY_DIR}/zephyr_ns_signed.bin
 

boards/arm/nucleo_l552ze_q/doc/nucleol552ze_q.rst

@@ -169,16 +169,16 @@ input/output, pull-up, etc.
 
 Available pins:
 ---------------
-.. image:: img/nucleo_l552ze_q_arduino.png
+.. image:: img/nucleo_l552ze_q_zio_left_2020_2_11.png
    :width: 720px
    :align: center
    :height: 540px
-   :alt: Nucleo L552ZE Q Arduino connectors
-.. image:: img/nucleo_l552ze_q_morpho.png
+   :alt: Nucleo L552ZE Q Zio left connector
+.. image:: img/nucleo_l552ze_q_zio_right_2020_2_11.png
    :width: 720px
    :align: center
    :height: 540px
-   :alt: Nucleo L552ZE Q Morpho connectors
+   :alt: Nucleo L552ZE Q Zio right connector
 
 For mode details please refer to `STM32 Nucleo-144 board User Manual`_.
 

boards/arm/nucleo_l552ze_q/nucleo_l552ze_q_ns_defconfig

@@ -50,5 +50,5 @@ CONFIG_CORTEX_M_SYSTICK=y
 CONFIG_RUNTIME_NMI=y
 CONFIG_TRUSTED_EXECUTION_NONSECURE=y
 # Flash configuration for TFM
-CONFIG_FLASH_LOAD_OFFSET=0x51400
-CONFIG_FLASH_LOAD_SIZE=0x2E000
+CONFIG_FLASH_LOAD_OFFSET=0x51000
+CONFIG_FLASH_LOAD_SIZE=0x2E400

boards/arm/stm32_min_dev/stm32_min_dev_black.dts

@@ -13,7 +13,7 @@
 
 	leds {
 		led: led {
-			gpios = <&gpiob 12 GPIO_ACTIVE_HIGH>;
+			gpios = <&gpiob 12 GPIO_ACTIVE_LOW>;
 		};
 	};
 };

boards/arm/stm32_min_dev/stm32_min_dev_blue.dts

@@ -13,7 +13,7 @@
 
 	leds {
 		led: led {
-			gpios = <&gpioc 13 GPIO_ACTIVE_HIGH>;
+			gpios = <&gpioc 13 GPIO_ACTIVE_LOW>;
 		};
 	};
 };

boards/arm/v2m_musca_b1/CMakeLists.txt

@@ -51,6 +51,7 @@ if (CONFIG_BUILD_WITH_TFM)
 			-v ${TFM_IMAGE_VERSION_S}
 			${ADD_SECURITY_COUNTER}
 			-H 0x400
+			--included-header
 			${CMAKE_BINARY_DIR}/tfm_full.bin
 			${CMAKE_BINARY_DIR}/tfm_sign.bin
 

boards/arm/v2m_musca_b1/v2m_musca_b1_nonsecure.dts

@@ -42,9 +42,9 @@
 		};
 	};
 
-	flash0: flash@0a070400 {
+	flash0: flash@0a070000 {
 		/* Embedded flash */
-		reg = <0x0a070400 0x19fc00>;
+		reg = <0x0a070000 0x1a0000>;
 	};
 
 	sram0: memory@20040000 {

cmake/extensions.cmake

@@ -217,7 +217,7 @@ function(zephyr_get_system_include_directories_for_lang lang i)
 
   process_flags(${lang} flags output_list)
   string(REPLACE ";" "$<SEMICOLON>" genexp_output_list "${output_list}")
-  set(result_output_list "-isystem$<JOIN:${genexp_output_list}, -isystem>")
+  set(result_output_list "$<$<BOOL:${genexp_output_list}>:-isystem$<JOIN:${genexp_output_list}, -isystem>>")
 
   set(${i} ${result_output_list} PARENT_SCOPE)
 endfunction()

doc/conf.py

@@ -542,6 +542,7 @@ html_context = {
     'theme_logo_only': False,
     'current_version': version,
     'versions': (("latest", "/"),
+                 ("2.4.0", "/2.4.0/"),
                  ("2.3.0", "/2.3.0/"),
                  ("2.2.0", "/2.2.0/"),
                  ("2.1.0", "/2.1.0/"),

doc/reference/overview.rst

@@ -27,7 +27,7 @@ current :ref:`stability level <api_lifecycle>`.
    * - :ref:`bluetooth_api`
      - Stable
      - 1.0
-     - 2.3
+     - 2.4
 
    * - :ref:`can_api`
      - Experimental
@@ -42,12 +42,12 @@ current :ref:`stability level <api_lifecycle>`.
    * - :ref:`device_model_api`
      - Stable
      - 1.0
-     - 2.3
+     - 2.4
 
    * - :ref:`devicetree_api`
      - Experimental
      - 2.2
-     - 2.3
+     - 2.4
 
    * - :ref:`display_api`
      - Unstable
@@ -57,12 +57,12 @@ current :ref:`stability level <api_lifecycle>`.
    * - :ref:`file_system_api`
      - Stable
      - 1.5
-     - 2.2
+     - 2.4
 
    * - :ref:`kernel_api`
      - Stable
      - 1.0
-     - 2.3
+     - 2.4
 
    * - :ref:`logging_api`
      - Stable
@@ -77,7 +77,7 @@ current :ref:`stability level <api_lifecycle>`.
    * - :ref:`networking_api`
      - Stable
      - 1.0
-     - 2.3
+     - 2.4
 
    * - :ref:`adc_api`
      - Stable
@@ -97,13 +97,18 @@ current :ref:`stability level <api_lifecycle>`.
    * - :ref:`dma_api`
      - Stable
      - 1.5
-     - 2.0
+     - 2.4
 
    * - :ref:`dac_api`
      - Experimental
      - 2.3
      - 2.3
 
+   * - :ref:`ec_host_cmd_periph_api`
+     - Experimental
+     - 2.4
+     - 2.4
+
    * - :ref:`eeprom_api`
      - Unstable
      - 2.1
@@ -117,7 +122,7 @@ current :ref:`stability level <api_lifecycle>`.
    * - :ref:`flash_api`
      - Stable
      - 1.2
-     - 1.10
+     - 2.4
 
    * - :ref:`gna_api`
      - Experimental
@@ -137,7 +142,7 @@ current :ref:`stability level <api_lifecycle>`.
    * - :ref:`i2c_api`
      - Stable
      - 1.0
-     - 2.1
+     - 2.4
 
    * - :ref:`i2s_api`
      - Stable
@@ -147,12 +152,12 @@ current :ref:`stability level <api_lifecycle>`.
    * - :ref:`ipm_api`
      - Stable
      - 1.0
-     - 1.0
+     - 2.4
 
    * - :ref:`led_api`
      - Stable
      - 1.12
-     - 1.12
+     - 2.4
 
    * - :ref:`kscan_api`
      - Stable
@@ -162,7 +167,7 @@ current :ref:`stability level <api_lifecycle>`.
    * - :ref:`peci_api`
      - Stable
      - 2.1
-     - 2.2
+     - 2.4
 
    * - :ref:`pinmux_api`
      - Stable
@@ -182,7 +187,7 @@ current :ref:`stability level <api_lifecycle>`.
    * - :ref:`sensor_api`
      - Stable
      - 1.2
-     - 2.3
+     - 2.4
 
    * - :ref:`spi_api`
      - Stable
@@ -192,7 +197,7 @@ current :ref:`stability level <api_lifecycle>`.
    * - :ref:`uart_api`
      - Stable
      - 1.0
-     - 2.2
+     - 2.4
 
    * - :ref:`UART async <uart_api>`
      - Unstable
@@ -227,7 +232,7 @@ current :ref:`stability level <api_lifecycle>`.
    * - :ref:`shell_api`
      - Stable
      - 1.14
-     - 2.3
+     - 2.4
 
    * - :ref:`disk_access_api`
      - Stable
@@ -262,7 +267,7 @@ current :ref:`stability level <api_lifecycle>`.
    * - :ref:`usb_api`
      - Stable
      - 1.5
-     - 2.3
+     - 2.4
 
    * - :ref:`usermode_api`
      - Stable

doc/reference/peripherals/ec_host_cmd_periph.rst

@@ -0,0 +1,14 @@
+.. _ec_host_cmd_periph_api:
+
+EC Host Command
+###############
+
+Overview
+********
+
+
+API Reference
+*************
+
+.. doxygengroup:: ec_host_cmd_periph_interface
+   :project: Zephyr

doc/reference/peripherals/index.rst

@@ -11,6 +11,7 @@ Peripherals
    clock_control.rst
    dac.rst
    dma.rst
+   ec_host_cmd_periph.rst
    eeprom.rst
    entropy.rst
    flash.rst

doc/releases/release-notes-2.5.rst

@@ -0,0 +1,229 @@
+:orphan:
+
+.. _zephyr_2.5:
+
+Zephyr 2.5.0 (Working Draft)
+############################
+
+We are pleased to announce the release of Zephyr RTOS version 2.5.0.
+
+Major enhancements with this release include:
+
+The following sections provide detailed lists of changes by component.
+
+Security Vulnerability Related
+******************************
+
+The following CVEs are addressed by this release:
+
+More detailed information can be found in:
+https://docs.zephyrproject.org/latest/security/vulnerabilities.html
+
+Known issues
+************
+
+You can check all currently known issues by listing them using the GitHub
+interface and listing all issues with the `bug label
+<https://github.com/zephyrproject-rtos/zephyr/issues?q=is%3Aissue+is%3Aopen+label%3Abug>`_.
+
+API Changes
+***********
+
+Deprecated in this release
+==========================
+
+Removed APIs in this release
+============================
+
+Stable API changes in this release
+==================================
+
+Kernel
+******
+
+Architectures
+*************
+
+* ARC
+
+* ARM
+
+  * AARCH32
+
+  * AARCH64
+
+* POSIX
+
+* RISC-V
+
+* x86
+
+Boards & SoC Support
+********************
+
+* Added support for these SoC series:
+
+* Made these changes in other SoC series:
+
+* Changes for ARC boards:
+
+* Added support for these ARM boards:
+
+* Made these changes in other boards:
+
+* Added support for these following shields:
+
+Drivers and Sensors
+*******************
+
+* ADC
+
+* Audio
+
+* Bluetooth
+
+* CAN
+
+* Clock Control
+
+* Console
+
+* Counter
+
+* Crypto
+
+* DAC
+
+* Debug
+
+* Display
+
+* DMA
+
+* EEPROM
+
+* Entropy
+
+* ESPI
+
+* Ethernet
+
+* Flash
+
+* GPIO
+
+* Hardware Info
+
+* I2C
+
+* I2S
+
+* IEEE 802.15.4
+
+* Interrupt Controller
+
+* IPM
+
+* Keyboard Scan
+
+* LED
+
+* LED Strip
+
+* LoRa
+
+* Modem
+
+* PECI
+
+* Pinmux
+
+* PS/2
+
+* PWM
+
+* Sensor
+
+* Serial
+
+* SPI
+
+* Timer
+
+* USB
+
+* Video
+
+* Watchdog
+
+* WiFi
+
+Networking
+**********
+
+Bluetooth
+*********
+
+* Host
+
+* Mesh
+
+* BLE split software Controller
+
+* HCI Driver
+
+Build and Infrastructure
+************************
+
+* Improved support for additional toolchains:
+
+* Devicetree
+
+Libraries / Subsystems
+**********************
+
+* Disk
+
+* Management
+
+  * MCUmgr
+
+  * updatehub
+
+* Settings
+
+* Random
+
+* POSIX subsystem
+
+* Power management
+
+* Logging
+
+* LVGL
+
+* Shell
+
+* Storage
+
+* Tracing
+
+* Debug
+
+HALs
+****
+
+* HALs are now moved out of the main tree as external modules and reside in
+  their own standalone repositories.
+
+Documentation
+*************
+
+Tests and Samples
+*****************
+
+Issue Related Items
+*******************
+
+These GitHub issues were addressed since the previous 2.4.0 tagged
+release:

doc/security/vulnerabilities.rst

@@ -353,13 +353,25 @@ available.
 
 See NCC-ZEP-030
 
-This issue has not been fixed.
+This has been fixed in a PR against Zephyr master.
 
 - `CVE-2020-10060 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10060>`_
 
 - `Zephyr project bug tracker ZEPSEC-37
   <https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-37>`_
 
+- `PR27865 fix on master (to be fixed in v2.4.0)
+  <https://github.com/zephyrproject-rtos/zephyr/pull/27865>`_
+
+- `PR27865 fix for v2.3.0
+  <https://github.com/zephyrproject-rtos/zephyr/pull/27889>`_
+
+- `PR27865 fix for v2.2.0
+  <https://github.com/zephyrproject-rtos/zephyr/pull/27891>`_
+
+- `PR27865 fix for v2.1.0
+  <https://github.com/zephyrproject-rtos/zephyr/pull/27893>`_
+
 CVE-2020-10061
 --------------
 
@@ -445,6 +457,35 @@ This has been fixed in master for v2.3.
 
 - `NCC-ZEP report`_ (NCC-ZEP-032)
 
+CVE-2020-10064
+--------------
+
+Improper Input Frame Validation in ieee802154 Processing
+
+- `CVE-2020-10064 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10064>`_
+
+- `Zephyr project bug tracker ZEPSEC-65
+  <https://zephyrprojectsec.atlasssian.net/browse/ZEPSEC-65>`_
+
+- `PR24971 fix for v2.4
+  <https://github.com/zephyrproject-rtos/zephyr/pull/24971>`_
+
+CVE-2020-10066
+--------------
+
+Incorrect Error Handling in Bluetooth HCI core
+
+In hci_cmd_done, the buf argument being passed as null causes
+nullpointer dereference.
+
+- `CVE-2020-10066 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10066>`_
+
+- `Zephyr project bug tracker ZEPSEC-67
+  <https://zephyrprojectsec.atlasssian.net/browse/ZEPSEC-67>`_
+
+- `PR24902 fix for v2.4
+  <https://github.com/zephyrproject-rtos/zephyr/pull/24902>`_
+
 CVE-2020-10067
 --------------
 
@@ -575,3 +616,77 @@ This has been fixed in master for v2.3.
   <https://github.com/zephyrproject-rtos/zephyr/pull/23821/commits/989c4713ba429aa5105fe476b4d629718f3e6082>`_
 
 - `NCC-ZEP report`_ (NCC-ZEP-031)
+
+CVE-2020-10072
+--------------
+
+All threads can access all socket file descriptors
+
+There is no management of permissions to network socket API file
+descriptors. Any thread running on the system may read/write a socket
+file descriptor knowing only the numerical value of the file
+descriptor.
+
+- `CVE-2020-10072 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10072>`_
+
+- `Zephyr project bug tracker ZEPSEC-87
+  <https://zephyrprojectsec.atlasssian.net/browse/ZEPSEC-87>`_
+
+- `PR25804 fix for v2.4
+  <https://github.com/zephyrproject-rtos/zephyr/pull/25804>`_
+
+
+CVE-2020-13598
+--------------
+
+FS: Buffer Overflow when enabling Long File Names in FAT_FS and calling fs_stat
+
+Performing fs_stat on a file with a filename longer than 12
+characters long will cause a buffer overflow.
+
+- `CVE-2020-13598 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13598>`_
+
+- `Zephyr project bug tracker ZEPSEC-88
+  <https://zephyrprojectsec.atlasssian.net/browse/ZEPSEC-88>`_
+
+- `PR25852 fix for v2.4
+  <https://github.com/zephyrproject-rtos/zephyr/pull/25852>`_
+
+CVE-2020-13599
+--------------
+
+Security problem with settings and littlefs
+
+When settings is used in combination with littlefs all security
+related information can be extracted from the device using MCUmgr and
+this could be used e.g in bt-mesh to get the device key, network key,
+app keys from the device.
+
+- `CVE-2020-13599 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13599>`_
+
+- `Zephyr project bug tracker ZEPSEC-57
+  <https://zephyrprojectsec.atlasssian.net/browse/ZEPSEC-57>`_
+
+- `PR26083 fix for v2.4
+  <https://github.com/zephyrproject-rtos/zephyr/pull/26083>`_
+
+CVE-2020-13601
+--------------
+
+Under embargo until 2020/11/18
+
+CVE-2020-13602
+--------------
+
+Remote Denial of Service in LwM2M do_write_op_tlv
+
+In the Zephyr LwM2M implementation, malformed input can result in an
+infinite loop, resulting in a denial of service attack.
+
+- `CVE-2020-13602 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13602>`_
+
+- `Zephyr project bug tracker ZEPSEC-56
+  <https://zephyrprojectsec.atlasssian.net/browse/ZEPSEC-56>`_
+
+- `PR26571 fix for v2.4
+  <https://github.com/zephyrproject-rtos/zephyr/pull/26571>`_

drivers/clock_control/clock_control_nrf.c

@@ -441,6 +441,21 @@ static void onoff_start(struct onoff_manager *mgr,
 	}
 }
 
+/** @brief Wait for LF clock availability or stability.
+ *
+ * If LF clock source is SYNTH or RC then there is no distinction between
+ * availability and stability. In case of XTAL source clock, system is initially
+ * starting RC and then seamlessly switches to XTAL. Running RC means clock
+ * availability and running target source means stability, That is because
+ * significant difference in startup time (<1ms vs >200ms).
+ *
+ * In order to get event/interrupt when RC is ready (allowing CPU sleeping) two
+ * stage startup sequence is used. Initially, LF source is set to RC and when
+ * LFSTARTED event is handled it is reconfigured to the target source clock.
+ * This approach is implemented in nrfx_clock driver and utilized here.
+ *
+ * @param mode Start mode.
+ */
 static void lfclk_spinwait(enum nrf_lfclk_start_mode mode)
 {
 	static const nrf_clock_domain_t d = NRF_CLOCK_DOMAIN_LFCLK;
@@ -454,6 +469,19 @@ static void lfclk_spinwait(enum nrf_lfclk_start_mode mode)
 		? NRF_CLOCK_LFCLK_Xtal
 		: CLOCK_CONTROL_NRF_K32SRC;
 	nrf_clock_lfclk_t type;
+
+	if ((mode == CLOCK_CONTROL_NRF_LF_START_AVAILABLE) &&
+	    (target_type == NRF_CLOCK_LFCLK_Xtal) &&
+	    (nrf_clock_lf_srccopy_get(NRF_CLOCK) == CLOCK_CONTROL_NRF_K32SRC)) {
+		/* If target clock source is using XTAL then due to two-stage
+		 * clock startup sequence, RC might already be running.
+		 * It can be determined by checking current LFCLK source. If it
+		 * is set to the target clock source then it means that RC was
+		 * started.
+		 */
+		return;
+	}
+
 	bool isr_mode = k_is_in_isr() || k_is_pre_kernel();
 	int key = isr_mode ? irq_lock() : 0;
 

drivers/ethernet/eth_enc424j600.c

@@ -600,6 +600,8 @@ static int enc424j600_init(const struct device *dev)
 	uint8_t retries = ENC424J600_DEFAULT_NUMOF_RETRIES;
 	uint16_t tmp;
 
+	context->dev = dev;
+
 	/* SPI config */
 	context->spi_cfg.operation = SPI_WORD_SET(8);
 	context->spi_cfg.frequency = config->spi_freq;

drivers/flash/CMakeLists.txt

@@ -7,7 +7,7 @@ zephyr_library_sources_ifdef(CONFIG_NORDIC_QSPI_NOR nrf_qspi_nor.c)
 zephyr_library_sources_ifdef(CONFIG_FLASH_SIMULATOR flash_simulator.c)
 zephyr_library_sources_ifdef(CONFIG_SPI_FLASH_AT45 spi_flash_at45.c)
 zephyr_library_sources_ifdef(CONFIG_SOC_FLASH_NRF soc_flash_nrf.c)
-zephyr_library_sources_ifdef(CONFIG_SOC_FLASH_NRF_RADIO_SYNC soc_flash_nrf_ticker.c)
+zephyr_library_sources_ifdef(CONFIG_SOC_FLASH_NRF_RADIO_SYNC_TICKER soc_flash_nrf_ticker.c)
 zephyr_library_sources_ifdef(CONFIG_SOC_FLASH_MCUX soc_flash_mcux.c)
 zephyr_library_sources_ifdef(CONFIG_FLASH_PAGE_LAYOUT flash_page_layout.c)
 zephyr_library_sources_ifdef(CONFIG_USERSPACE flash_handlers.c)
@@ -30,7 +30,7 @@ if(CONFIG_SOC_FLASH_STM32)
 endif()
 
 zephyr_include_directories_ifdef(
-	CONFIG_SOC_FLASH_NRF_RADIO_SYNC
+	CONFIG_SOC_FLASH_NRF_RADIO_SYNC_TICKER
 	${ZEPHYR_BASE}/subsys/bluetooth
 	${ZEPHYR_BASE}/subsys/bluetooth/controller/ll_sw/nordic
 	)

drivers/flash/Kconfig.nrf

@@ -20,16 +20,16 @@ menuconfig SOC_FLASH_NRF
 
 if SOC_FLASH_NRF
 
-choice
+choice SOC_FLASH_NRF_RADIO_SYNC_CHOICE
 	prompt "Nordic nRFx flash driver synchronization"
-	default SOC_FLASH_NRF_RADIO_SYNC if BT_CTLR
+	default SOC_FLASH_NRF_RADIO_SYNC_TICKER if BT_LL_SW_SPLIT
 	default SOC_FLASH_NRF_RADIO_SYNC_NONE
 	help
 	  synchronization between flash memory driver and radio.
 
-config SOC_FLASH_NRF_RADIO_SYNC
+config SOC_FLASH_NRF_RADIO_SYNC_TICKER
 	bool "Nordic nRFx flash driver synchronized with radio"
-	depends on BT_CTLR
+	depends on BT_LL_SW_SPLIT
 	help
 	  Enable synchronization between flash memory driver and radio using
 	  BLE LL controller ticker API.
@@ -50,7 +50,7 @@ config SOC_FLASH_NRF_PARTIAL_ERASE
 	  This allows interrupting flash erase between operations
 	  to perform other task by MCU.
 	  This feature may also be used for better syncing flash erase
-	  operations, when compiled with SOC_FLASH_NRF_RADIO_SYNC,
+	  operations, when compiled with SOC_FLASH_NRF_RADIO_SYNC_TICKER,
 	  with Bluetooth.
 
 config SOC_FLASH_NRF_PARTIAL_ERASE_MS

drivers/flash/nrf_qspi_nor.c

@@ -403,16 +403,16 @@ static inline void qspi_fill_init_struct(nrfx_qspi_config_t *initstruct)
 #endif
 
 	/* Configure Protocol interface */
-#if DT_INST_NODE_HAS_PROP(0, readoc_enum)
+#if DT_INST_NODE_HAS_PROP(0, readoc)
 	initstruct->prot_if.readoc =
-		(nrf_qspi_writeoc_t)qspi_get_lines_read(DT_INST_PROP(0, readoc_enum));
+		(nrf_qspi_writeoc_t)qspi_get_lines_read(DT_ENUM_IDX(DT_DRV_INST(0), readoc));
 #else
 	initstruct->prot_if.readoc = NRF_QSPI_READOC_FASTREAD;
 #endif
 
-#if DT_INST_NODE_HAS_PROP(0, writeoc_enum)
+#if DT_INST_NODE_HAS_PROP(0, writeoc)
 	initstruct->prot_if.writeoc =
-		(nrf_qspi_writeoc_t)qspi_get_lines_write(DT_INST_PROP(0, writeoc_enum));
+		(nrf_qspi_writeoc_t)qspi_get_lines_write(DT_ENUM_IDX(DT_DRV_INST(0), writeoc));
 #else
 	initstruct->prot_if.writeoc = NRF_QSPI_WRITEOC_PP;
 #endif

drivers/net/slip.c

@@ -395,7 +395,7 @@ static void slip_iface_init(struct net_if *iface)
 	struct slip_context *slip = net_if_get_device(iface)->data;
 	struct net_linkaddr *ll_addr;
 
-#if defined(CONFIG_NET_L2_ETHERNET)
+#if defined(CONFIG_SLIP_TAP) && defined(CONFIG_NET_L2_ETHERNET)
 	ethernet_init(iface);
 #endif
 

drivers/sensor/hts221/hts221.c

@@ -106,7 +106,7 @@ static int hts221_read_conversion_data(const struct device *dev)
 }
 
 static const struct sensor_driver_api hts221_driver_api = {
-#if CONFIG_HTS221_TRIGGER
+#if HTS221_TRIGGER_ENABLED
 	.trigger_set = hts221_trigger_set,
 #endif
 	.sample_fetch = hts221_sample_fetch,
@@ -168,11 +168,13 @@ int hts221_init(const struct device *dev)
 		return -EINVAL;
 	}
 
-#ifdef CONFIG_HTS221_TRIGGER
+#if HTS221_TRIGGER_ENABLED
 	if (hts221_init_interrupt(dev) < 0) {
 		LOG_ERR("Failed to initialize interrupt.");
 		return -EIO;
 	}
+#else
+	LOG_INF("Cannot enable trigger without drdy-gpios");
 #endif
 
 	return 0;
@@ -182,11 +184,11 @@ static struct hts221_data hts221_driver;
 static const struct hts221_config hts221_cfg = {
 	.i2c_bus = DT_INST_BUS_LABEL(0),
 	.i2c_addr = DT_INST_REG_ADDR(0),
-#ifdef CONFIG_HTS221_TRIGGER
+#if HTS221_TRIGGER_ENABLED
 	.drdy_pin = DT_INST_GPIO_PIN(0, drdy_gpios),
 	.drdy_flags = DT_INST_GPIO_FLAGS(0, drdy_gpios),
 	.drdy_controller = DT_INST_GPIO_LABEL(0, drdy_gpios),
-#endif /* CONFIG_HTS221_TRIGGER */
+#endif /* HTS221_TRIGGER_ENABLED */
 };
 
 DEVICE_AND_API_INIT(hts221, DT_INST_LABEL(0), hts221_init,

drivers/sensor/hts221/hts221.h

@@ -12,6 +12,9 @@
 #include <zephyr/types.h>
 #include <drivers/gpio.h>
 
+#define HTS221_TRIGGER_ENABLED (DT_INST_NODE_HAS_PROP(0, drdy_gpios) && \
+				IS_ENABLED(CONFIG_HTS221_TRIGGER))
+
 #define HTS221_AUTOINCREMENT_ADDR	BIT(7)
 
 #define HTS221_REG_WHO_AM_I		0x0F
@@ -42,7 +45,7 @@ struct hts221_data {
 	int16_t t0_out;
 	int16_t t1_out;
 
-#ifdef CONFIG_HTS221_TRIGGER
+#if HTS221_TRIGGER_ENABLED
 	const struct device *dev;
 	const struct device *drdy_dev;
 	struct gpio_callback drdy_cb;
@@ -58,20 +61,20 @@ struct hts221_data {
 	struct k_work work;
 #endif
 
-#endif /* CONFIG_HTS221_TRIGGER */
+#endif /* HTS221_TRIGGER_ENABLED */
 };
 
 struct hts221_config {
 	const char *i2c_bus;
 	uint16_t i2c_addr;
-#ifdef CONFIG_HTS221_TRIGGER
+#if HTS221_TRIGGER_ENABLED
 	gpio_pin_t drdy_pin;
 	gpio_flags_t drdy_flags;
 	const char *drdy_controller;
-#endif /* CONFIG_HTS221_TRIGGER */
+#endif /* HTS221_TRIGGER_ENABLED */
 };
 
-#ifdef CONFIG_HTS221_TRIGGER
+#if HTS221_TRIGGER_ENABLED
 int hts221_trigger_set(const struct device *dev,
 			const struct sensor_trigger *trig,
 			sensor_trigger_handler_t handler);

drivers/sensor/hts221/hts221_trigger.c

@@ -4,6 +4,8 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+#define DT_DRV_COMPAT st_hts221
+
 #include <device.h>
 #include <drivers/i2c.h>
 #include <sys/__assert.h>
@@ -13,6 +15,7 @@
 #include <logging/log.h>
 #include "hts221.h"
 
+#if HTS221_TRIGGER_ENABLED
 LOG_MODULE_DECLARE(HTS221, CONFIG_SENSOR_LOG_LEVEL);
 
 static inline void setup_drdy(const struct device *dev,
@@ -163,3 +166,4 @@ int hts221_init_interrupt(const struct device *dev)
 
 	return 0;
 }
+#endif /* HTS221_TRIGGER_ENABLED */

drivers/sensor/lsm6dsl/lsm6dsl_shub.c

@@ -34,7 +34,7 @@ LOG_MODULE_DECLARE(LSM6DSL, CONFIG_SENSOR_LOG_LEVEL);
 #define LSM6DSL_EMBEDDED_SLVX_THREE_SENS 0x20
 #define LSM6DSL_EMBEDDED_SLV0_WRITE_IDLE 0x07
 
-static int lsm6dsl_shub_write_slave_reg(struct lsm6dsl_data *data,
+static int lsm6dsl_shub_write_slave_reg(const struct device *dev,
 					uint8_t slv_addr, uint8_t slv_reg,
 					uint8_t *value, uint16_t len);
 
@@ -53,15 +53,16 @@ static int lsm6dsl_shub_write_slave_reg(struct lsm6dsl_data *data,
 #define LIS2MDL_OFF_CANC          0x02
 #define LIS2MDL_SENSITIVITY       1500
 
-static int lsm6dsl_lis2mdl_init(struct lsm6dsl_data *data, uint8_t i2c_addr)
+static int lsm6dsl_lis2mdl_init(const struct device *dev, uint8_t i2c_addr)
 {
+	struct lsm6dsl_data *data = dev->data;
 	uint8_t mag_cfg[2];
 
 	data->magn_sensitivity = LIS2MDL_SENSITIVITY;
 
 	/* sw reset device */
 	mag_cfg[0] = LIS2MDL_SW_RESET;
-	lsm6dsl_shub_write_slave_reg(data, i2c_addr,
+	lsm6dsl_shub_write_slave_reg(dev, i2c_addr,
 				     LIS2MDL_CFG_REG_A, mag_cfg, 1);
 
 	k_sleep(K_MSEC(10)); /* turn-on time in ms */
@@ -69,7 +70,7 @@ static int lsm6dsl_lis2mdl_init(struct lsm6dsl_data *data, uint8_t i2c_addr)
 	/* configure mag */
 	mag_cfg[0] = LIS2MDL_ODR_10HZ;
 	mag_cfg[1] = LIS2MDL_OFF_CANC;
-	lsm6dsl_shub_write_slave_reg(data, i2c_addr,
+	lsm6dsl_shub_write_slave_reg(dev, i2c_addr,
 				     LIS2MDL_CFG_REG_A, mag_cfg, 2);
 
 	return 0;
@@ -89,20 +90,20 @@ static int lsm6dsl_lis2mdl_init(struct lsm6dsl_data *data, uint8_t i2c_addr)
 #define LPS22HB_LPF_EN            0x08
 #define LPS22HB_BDU_EN            0x02
 
-static int lsm6dsl_lps22hb_init(struct lsm6dsl_data *data, uint8_t i2c_addr)
+static int lsm6dsl_lps22hb_init(const struct device *dev, uint8_t i2c_addr)
 {
 	uint8_t baro_cfg[2];
 
 	/* sw reset device */
 	baro_cfg[0] = LPS22HB_SW_RESET;
-	lsm6dsl_shub_write_slave_reg(data, i2c_addr,
+	lsm6dsl_shub_write_slave_reg(dev, i2c_addr,
 				     LPS22HB_CTRL_REG2, baro_cfg, 1);
 
 	k_sleep(K_MSEC(1)); /* turn-on time in ms */
 
 	/* configure device */
 	baro_cfg[0] = LPS22HB_ODR_10HZ | LPS22HB_LPF_EN | LPS22HB_BDU_EN;
-	lsm6dsl_shub_write_slave_reg(data, i2c_addr,
+	lsm6dsl_shub_write_slave_reg(dev, i2c_addr,
 				     LPS22HB_CTRL_REG1, baro_cfg, 1);
 
 	return 0;
@@ -116,7 +117,7 @@ static struct lsm6dsl_shub_sens_list {
 	uint8_t wai_val;
 	uint8_t out_data_addr;
 	uint8_t out_data_len;
-	int (*dev_init)(struct lsm6dsl_data *data, uint8_t i2c_addr);
+	int (*dev_init)(const struct device *dev, uint8_t i2c_addr);
 } lsm6dsl_shub_sens_list[] = {
 #ifdef CONFIG_LSM6DSL_EXT0_LIS2MDL
 	{
@@ -145,19 +146,21 @@ static struct lsm6dsl_shub_sens_list {
 
 static uint8_t ext_i2c_addr;
 
-static inline void lsm6dsl_shub_wait_completed(struct lsm6dsl_data *data)
+static inline void lsm6dsl_shub_wait_completed(const struct device *dev)
 {
+	struct lsm6dsl_data *data = dev->data;
 	uint16_t freq;
 
 	freq = (data->accel_freq == 0U) ? 26 : data->accel_freq;
 	k_msleep((2000U / freq) + 1);
 }
 
-static inline void lsm6dsl_shub_embedded_en(struct lsm6dsl_data *data, bool on)
+static inline void lsm6dsl_shub_embedded_en(const struct device *dev, bool on)
 {
+	struct lsm6dsl_data *data = dev->data;
 	uint8_t func_en = (on) ? 0x1 : 0x0;
 
-	data->hw_tf->update_reg(data, LSM6DSL_REG_FUNC_CFG_ACCESS,
+	data->hw_tf->update_reg(dev, LSM6DSL_REG_FUNC_CFG_ACCESS,
 				LSM6DSL_MASK_FUNC_CFG_EN,
 				func_en << LSM6DSL_SHIFT_FUNC_CFG_EN);
 
@@ -165,78 +168,84 @@ static inline void lsm6dsl_shub_embedded_en(struct lsm6dsl_data *data, bool on)
 }
 
 #ifdef LSM6DSL_DEBUG
-static int lsm6dsl_read_embedded_reg(struct lsm6dsl_data *data,
+static int lsm6dsl_read_embedded_reg(const struct device *dev,
 				     uint8_t reg_addr, uint8_t *value, int len)
 {
-	lsm6dsl_shub_embedded_en(data, true);
+	struct lsm6dsl_data *data = dev->data;
+	lsm6dsl_shub_embedded_en(dev, true);
 
-	if (data->hw_tf->read_data(data, reg_addr, value, len) < 0) {
+	if (data->hw_tf->read_data(dev, reg_addr, value, len) < 0) {
 		LOG_DBG("failed to read external reg: %02x", reg_addr);
-		lsm6dsl_shub_embedded_en(data, false);
+		lsm6dsl_shub_embedded_en(dev, false);
 		return -EIO;
 	}
 
-	lsm6dsl_shub_embedded_en(data, false);
+	lsm6dsl_shub_embedded_en(dev, false);
 
 	return 0;
 }
 #endif
 
-static int lsm6dsl_shub_write_embedded_regs(struct lsm6dsl_data *data,
+static int lsm6dsl_shub_write_embedded_regs(const struct device *dev,
 					    uint8_t reg_addr,
 					    uint8_t *value, uint8_t len)
 {
-	lsm6dsl_shub_embedded_en(data, true);
+	struct lsm6dsl_data *data = dev->data;
+	lsm6dsl_shub_embedded_en(dev, true);
 
-	if (data->hw_tf->write_data(data, reg_addr, value, len) < 0) {
+	if (data->hw_tf->write_data(dev, reg_addr, value, len) < 0) {
 		LOG_DBG("failed to write external reg: %02x", reg_addr);
-		lsm6dsl_shub_embedded_en(data, false);
+		lsm6dsl_shub_embedded_en(dev, false);
 		return -EIO;
 	}
 
-	lsm6dsl_shub_embedded_en(data, false);
+	lsm6dsl_shub_embedded_en(dev, false);
 
 	return 0;
 }
 
-static void lsm6dsl_shub_enable(struct lsm6dsl_data *data)
+static void lsm6dsl_shub_enable(const struct device *dev)
 {
+	struct lsm6dsl_data *data = dev->data;
+
 	/* Enable Digital Func */
-	data->hw_tf->update_reg(data, LSM6DSL_REG_CTRL10_C,
+	data->hw_tf->update_reg(dev, LSM6DSL_REG_CTRL10_C,
 				LSM6DSL_MASK_CTRL10_C_FUNC_EN,
 				1 << LSM6DSL_SHIFT_CTRL10_C_FUNC_EN);
 
 	/* Enable Accel @26hz */
 	if (!data->accel_freq) {
-		data->hw_tf->update_reg(data,
+		data->hw_tf->update_reg(dev,
 				    LSM6DSL_REG_CTRL1_XL,
 				    LSM6DSL_MASK_CTRL1_XL_ODR_XL,
 				    2 << LSM6DSL_SHIFT_CTRL1_XL_ODR_XL);
 	}
 
 	/* Enable Sensor Hub */
-	data->hw_tf->update_reg(data, LSM6DSL_REG_MASTER_CONFIG,
+	data->hw_tf->update_reg(dev, LSM6DSL_REG_MASTER_CONFIG,
 				LSM6DSL_MASK_MASTER_CONFIG_MASTER_ON,
 				1 << LSM6DSL_SHIFT_MASTER_CONFIG_MASTER_ON);
 }
 
-static void lsm6dsl_shub_disable(struct lsm6dsl_data *data)
+static void lsm6dsl_shub_disable(const struct device *dev)
 {
+	struct lsm6dsl_data *data = dev->data;
+
 	/* Disable Sensor Hub */
-	data->hw_tf->update_reg(data, LSM6DSL_REG_MASTER_CONFIG,
+	data->hw_tf->update_reg(dev, LSM6DSL_REG_MASTER_CONFIG,
 				LSM6DSL_MASK_MASTER_CONFIG_MASTER_ON,
 				0 << LSM6DSL_SHIFT_MASTER_CONFIG_MASTER_ON);
 
 	/* Disable Accel */
 	if (!data->accel_freq) {
-		data->hw_tf->update_reg(data,
+		data->hw_tf->update_reg(dev,
 				    LSM6DSL_REG_CTRL1_XL,
 				    LSM6DSL_MASK_CTRL1_XL_ODR_XL,
 				    0 << LSM6DSL_SHIFT_CTRL1_XL_ODR_XL);
 	}
 
 	/* Disable Digital Func */
-	data->hw_tf->update_reg(data, LSM6DSL_REG_CTRL10_C,
+	data->hw_tf->update_reg(dev, LSM6DSL_REG_CTRL10_C,
 				LSM6DSL_MASK_CTRL10_C_FUNC_EN,
 				0 << LSM6DSL_SHIFT_CTRL10_C_FUNC_EN);
 }
@@ -244,35 +253,36 @@ static void lsm6dsl_shub_disable(struct lsm6dsl_data *data)
 /*
  * use SLV0 for generic read to slave device
  */
-static int lsm6dsl_shub_read_slave_reg(struct lsm6dsl_data *data,
+static int lsm6dsl_shub_read_slave_reg(const struct device *dev,
 				       uint8_t slv_addr, uint8_t slv_reg,
 				       uint8_t *value, uint16_t len)
 {
+	struct lsm6dsl_data *data = dev->data;
 	uint8_t slave[3];
 
 	slave[0] = (slv_addr << 1) | LSM6DSL_EMBEDDED_SLVX_READ;
 	slave[1] = slv_reg;
 	slave[2] = (len & 0x7);
 
-	if (lsm6dsl_shub_write_embedded_regs(data, LSM6DSL_EMBEDDED_SLV0_ADDR,
+	if (lsm6dsl_shub_write_embedded_regs(dev, LSM6DSL_EMBEDDED_SLV0_ADDR,
 					     slave, 3) < 0) {
 		LOG_DBG("error writing embedded reg");
 		return -EIO;
 	}
 
 	/* turn SH on */
-	lsm6dsl_shub_enable(data);
-	lsm6dsl_shub_wait_completed(data);
-	data->hw_tf->read_data(data, LSM6DSL_REG_SENSORHUB1, value, len);
+	lsm6dsl_shub_enable(dev);
+	lsm6dsl_shub_wait_completed(dev);
+	data->hw_tf->read_data(dev, LSM6DSL_REG_SENSORHUB1, value, len);
 
-	lsm6dsl_shub_disable(data);
+	lsm6dsl_shub_disable(dev);
 	return 0;
 }
 
 /*
  * use SLV0 to configure slave device
  */
-static int lsm6dsl_shub_write_slave_reg(struct lsm6dsl_data *data,
+static int lsm6dsl_shub_write_slave_reg(const struct device *dev,
 					uint8_t slv_addr, uint8_t slv_reg,
 					uint8_t *value, uint16_t len)
 {
@@ -283,7 +293,7 @@ static int lsm6dsl_shub_write_slave_reg(struct lsm6dsl_data *data,
 		slv_cfg[0] = (slv_addr << 1) & ~LSM6DSL_EMBEDDED_SLVX_READ;
 		slv_cfg[1] = slv_reg + cnt;
 
-		if (lsm6dsl_shub_write_embedded_regs(data,
+		if (lsm6dsl_shub_write_embedded_regs(dev,
 						     LSM6DSL_EMBEDDED_SLV0_ADDR,
 						     slv_cfg, 2) < 0) {
 			LOG_DBG("error writing embedded reg");
@@ -291,7 +301,7 @@ static int lsm6dsl_shub_write_slave_reg(struct lsm6dsl_data *data,
 		}
 
 		slv_cfg[0] = value[cnt];
-		if (lsm6dsl_shub_write_embedded_regs(data,
+		if (lsm6dsl_shub_write_embedded_regs(dev,
 					LSM6DSL_EMBEDDED_SLV0_DATAWRITE,
 					slv_cfg, 1) < 0) {
 			LOG_DBG("error writing embedded reg");
@@ -299,9 +309,9 @@ static int lsm6dsl_shub_write_slave_reg(struct lsm6dsl_data *data,
 		}
 
 		/* turn SH on */
-		lsm6dsl_shub_enable(data);
-		lsm6dsl_shub_wait_completed(data);
-		lsm6dsl_shub_disable(data);
+		lsm6dsl_shub_enable(dev);
+		lsm6dsl_shub_wait_completed(dev);
+		lsm6dsl_shub_disable(dev);
 
 		cnt++;
 	}
@@ -310,7 +320,7 @@ static int lsm6dsl_shub_write_slave_reg(struct lsm6dsl_data *data,
 	slv_cfg[0] = LSM6DSL_EMBEDDED_SLV0_WRITE_IDLE;
 	slv_cfg[1] = lsm6dsl_shub_sens_list[0].wai_addr;
 	slv_cfg[2] = LSM6DSL_EMBEDDED_SLVX_THREE_SENS;
-	if (lsm6dsl_shub_write_embedded_regs(data,
+	if (lsm6dsl_shub_write_embedded_regs(dev,
 					     LSM6DSL_EMBEDDED_SLV0_ADDR,
 					     slv_cfg, 3) < 0) {
 		LOG_DBG("error writing embedded reg");
@@ -327,7 +337,7 @@ static int lsm6dsl_shub_write_slave_reg(struct lsm6dsl_data *data,
  *  - SLAVE 1: used as data read channel to slave device
  *  - SLAVE 2: used for generic reads while data channel is enabled
  */
-static int lsm6dsl_shub_set_data_channel(struct lsm6dsl_data *data)
+static int lsm6dsl_shub_set_data_channel(const struct device *dev)
 {
 	uint8_t slv_cfg[3];
 	uint8_t slv_i2c_addr = lsm6dsl_shub_sens_list[0].i2c_addr[ext_i2c_addr];
@@ -336,7 +346,7 @@ static int lsm6dsl_shub_set_data_channel(struct lsm6dsl_data *data)
 	slv_cfg[0] = LSM6DSL_EMBEDDED_SLV0_WRITE_IDLE;
 	slv_cfg[1] = lsm6dsl_shub_sens_list[0].wai_addr;
 	slv_cfg[2] = LSM6DSL_EMBEDDED_SLVX_THREE_SENS;
-	if (lsm6dsl_shub_write_embedded_regs(data,
+	if (lsm6dsl_shub_write_embedded_regs(dev,
 					     LSM6DSL_EMBEDDED_SLV0_ADDR,
 					     slv_cfg, 3) < 0) {
 		LOG_DBG("error writing embedded reg");
@@ -347,7 +357,7 @@ static int lsm6dsl_shub_set_data_channel(struct lsm6dsl_data *data)
 	slv_cfg[0] = (slv_i2c_addr << 1) | LSM6DSL_EMBEDDED_SLVX_READ;
 	slv_cfg[1] = lsm6dsl_shub_sens_list[0].out_data_addr;
 	slv_cfg[2] = lsm6dsl_shub_sens_list[0].out_data_len;
-	if (lsm6dsl_shub_write_embedded_regs(data,
+	if (lsm6dsl_shub_write_embedded_regs(dev,
 					     LSM6DSL_EMBEDDED_SLV1_ADDR,
 					     slv_cfg, 3) < 0) {
 		LOG_DBG("error writing embedded reg");
@@ -355,8 +365,8 @@ static int lsm6dsl_shub_set_data_channel(struct lsm6dsl_data *data)
 	}
 
 	/* turn SH on */
-	lsm6dsl_shub_enable(data);
-	lsm6dsl_shub_wait_completed(data);
+	lsm6dsl_shub_enable(dev);
+	lsm6dsl_shub_wait_completed(dev);
 
 	return 0;
 }
@@ -366,14 +376,13 @@ int lsm6dsl_shub_read_external_chip(const struct device *dev, uint8_t *buf,
 {
 	struct lsm6dsl_data *data = dev->data;
 
-	data->hw_tf->read_data(data, LSM6DSL_REG_SENSORHUB1, buf, len);
+	data->hw_tf->read_data(dev, LSM6DSL_REG_SENSORHUB1, buf, len);
 
 	return 0;
 }
 
 int lsm6dsl_shub_init_external_chip(const struct device *dev)
 {
-	struct lsm6dsl_data *data = dev->data;
 	uint8_t i;
 	uint8_t chip_id = 0U;
 	uint8_t slv_i2c_addr;
@@ -391,7 +400,7 @@ int lsm6dsl_shub_init_external_chip(const struct device *dev)
 			continue;
 		}
 
-		if (lsm6dsl_shub_read_slave_reg(data, slv_i2c_addr,
+		if (lsm6dsl_shub_read_slave_reg(dev, slv_i2c_addr,
 						slv_wai_addr,
 						&chip_id, 1) < 0) {
 			LOG_DBG("failed reading external chip id");
@@ -410,9 +419,9 @@ int lsm6dsl_shub_init_external_chip(const struct device *dev)
 	ext_i2c_addr = i;
 
 	/* init external device */
-	lsm6dsl_shub_sens_list[0].dev_init(data, slv_i2c_addr);
+	lsm6dsl_shub_sens_list[0].dev_init(dev, slv_i2c_addr);
 
-	lsm6dsl_shub_set_data_channel(data);
+	lsm6dsl_shub_set_data_channel(dev);
 
 	return 0;
 }

dts/arm/atmel/sam4l-pinctrl.dtsi

@@ -26,7 +26,7 @@
 			DT_ATMEL_GPIO(spi, npcs0, a, 30, a);
 			DT_ATMEL_GPIO(spi, npcs0, c, 3, a);
 			DT_ATMEL_GPIO(spi, npcs0, c, 31, b);
-			DT_ATMEL_GPIO(spi, npcs1, c, 13, c);
+			DT_ATMEL_GPIO(spi, npcs1, a, 13, c);
 			DT_ATMEL_GPIO(spi, npcs1, a, 31, a);
 			DT_ATMEL_GPIO(spi, npcs1, b, 13, b);
 			DT_ATMEL_GPIO(spi, npcs1, c, 2, a);
@@ -94,7 +94,7 @@
 			DT_ATMEL_GPIO(usart3, rts3, c, 30, a);
 			DT_ATMEL_GPIO(usart3, rxd3, a, 30, a);
 			DT_ATMEL_GPIO(usart3, rxd3, b, 9, a);
-			DT_ATMEL_GPIO(usart3, rxd3, c, 9, a);
+			DT_ATMEL_GPIO(usart3, rxd3, c, 9, b);
 			DT_ATMEL_GPIO(usart3, rxd3, c, 28, a);
 			DT_ATMEL_GPIO(usart3, clk3, a, 29, e);
 			DT_ATMEL_GPIO(usart3, clk3, b, 8, a);

dts/arm/nxp/nxp_rt6xx.dtsi

@@ -11,8 +11,8 @@
 
 / {
 	soc {
-		sram: sram@30000000 {
-			ranges = <0x20000000 0x30000000 0x480000>;
+		sram: sram@30018000 {
+			ranges = <0x20180000 0x30180000 0x300000>;
 		};
 
 		peripheral: peripheral@50000000 {

dts/arm/nxp/nxp_rt6xx_common.dtsi

@@ -38,9 +38,9 @@
 	#address-cells = <1>;
 	#size-cells = <1>;
 
-	sram0: memory@20000000 {
+	sram0: memory@20180000 {
 		compatible = "mmio-sram";
-		reg = <0x20000000 DT_SIZE_K(4608)>;
+		reg = <0x20180000 DT_SIZE_K(3072)>;
 	};
 };
 

dts/arm/nxp/nxp_rt6xx_ns.dtsi

@@ -6,8 +6,8 @@
 
 / {
 	soc {
-		sram: sram@20000000 {
-			ranges = <0x20000000 0x20000000 0x480000>;
+		sram: sram@20180000 {
+			ranges = <0x20180000 0x20180000 0x300000>;
 		};
 
 		peripheral: peripheral@40000000 {

include/bluetooth/l2cap.h

@@ -219,7 +219,8 @@ struct bt_l2cap_chan_ops {
 	/** @brief Channel alloc_buf callback
 	 *
 	 *  If this callback is provided the channel will use it to allocate
-	 *  buffers to store incoming data.
+	 *  buffers to store incoming data. Channels that requires segmentation
+	 *  must set this callback.
 	 *
 	 *  @param chan The channel requesting a buffer.
 	 *

include/bluetooth/uuid.h

@@ -441,7 +441,7 @@ struct bt_uuid_128 {
  *  @brief Environmental Sensing Trigger Setting Descriptor
  */
 #define BT_UUID_ES_TRIGGER_SETTING \
-	BT_UUID_DECLARE_16(BT_UUID_ES_MEASUREMENT_VAL)
+	BT_UUID_DECLARE_16(BT_UUID_ES_TRIGGER_SETTING_VAL)
 /** @def BT_UUID_GAP_DEVICE_NAME_VAL
  *  @brief GAP Characteristic Device Name UUID value
  */

include/ec_host_cmd.h

@@ -7,6 +7,13 @@
 #ifndef ZEPHYR_INCLUDE_EC_HOST_CMD_H_
 #define ZEPHYR_INCLUDE_EC_HOST_CMD_H_
 
+/**
+ * @brief EC Host Command Interface
+ * @defgroup ec_host_cmd_periph_interface EC Host Command Interface
+ * @ingroup io_interfaces
+ * @{
+ */
+
 #include <stdint.h>
 
 /**
@@ -194,4 +201,8 @@ enum ec_host_cmd_status {
 } __packed;
 BUILD_ASSERT(sizeof(enum ec_host_cmd_status) == sizeof(uint16_t));
 
+/**
+ * @}
+ */
+
 #endif /* ZEPHYR_INCLUDE_EC_HOST_CMD_H_ */

include/kernel.h

@@ -3997,6 +3997,9 @@ int k_msgq_cleanup(struct k_msgq *msgq);
  * This routine sends a message to message queue @a q.
  *
  * @note Can be called by ISRs.
+ * @note The message content is copied from @a data into @a msgq and the @a data
+ * pointer is not retained, so the message content will not be modified
+ * by this function.
  *
  * @param msgq Address of the message queue.
  * @param data Pointer to the message.
@@ -4008,7 +4011,7 @@ int k_msgq_cleanup(struct k_msgq *msgq);
  * @retval -ENOMSG Returned without waiting or queue purged.
  * @retval -EAGAIN Waiting period timed out.
  */
-__syscall int k_msgq_put(struct k_msgq *msgq, void *data, k_timeout_t timeout);
+__syscall int k_msgq_put(struct k_msgq *msgq, const void *data, k_timeout_t timeout);
 
 /**
  * @brief Receive a message from a message queue.

include/net/gptp.h

@@ -34,7 +34,12 @@ extern "C" {
 
 #define GPTP_PRIORITY1_NON_GM_CAPABLE      255
 #define GPTP_PRIORITY1_GM_CAPABLE          248
+
+#if defined(CONFIG_NET_GPTP_BMCA_PRIORITY2)
+#define GPTP_PRIORITY2_DEFAULT             CONFIG_NET_GPTP_BMCA_PRIORITY2
+#else
 #define GPTP_PRIORITY2_DEFAULT             248
+#endif
 
 /** @endcond */
 

include/net/net_pkt.h

@@ -900,6 +900,11 @@ static inline uint8_t *net_pkt_ip_data(struct net_pkt *pkt)
 	return pkt->frags->data;
 }
 
+static inline bool net_pkt_is_empty(struct net_pkt *pkt)
+{
+	return !pkt->buffer || !net_pkt_data(pkt) || pkt->buffer->len == 0;
+}
+
 static inline struct net_linkaddr *net_pkt_lladdr_src(struct net_pkt *pkt)
 {
 	return &pkt->lladdr_src;

include/storage/flash_map.h

@@ -111,6 +111,9 @@ int flash_area_check_int_sha256(const struct flash_area *fa,
  * @param[in]  id ID of the flash partition.
  * @param[out] fa Pointer which has to reference flash_area. If
  * @p ID is unknown, it will be NULL on output.
+ *
+ * @return  0 on success, -EACCES if the flash_map is not available ,
+ * -ENOENT if @p ID is unknown.
  */
 int flash_area_open(uint8_t id, const struct flash_area **fa);
 

include/sys/byteorder.h

@@ -421,7 +421,7 @@ static inline uint32_t sys_get_be32(const uint8_t src[4])
  */
 static inline uint64_t sys_get_be48(const uint8_t src[6])
 {
-	return ((uint64_t)sys_get_be32(&src[0]) << 32) | sys_get_be16(&src[4]);
+	return ((uint64_t)sys_get_be32(&src[0]) << 16) | sys_get_be16(&src[4]);
 }
 
 /**
@@ -496,7 +496,7 @@ static inline uint32_t sys_get_le32(const uint8_t src[4])
  */
 static inline uint64_t sys_get_le48(const uint8_t src[6])
 {
-	return ((uint64_t)sys_get_le32(&src[2]) << 32) | sys_get_le16(&src[0]);
+	return ((uint64_t)sys_get_le32(&src[2]) << 16) | sys_get_le16(&src[0]);
 }
 
 /**

kernel/CMakeLists.txt

@@ -50,6 +50,10 @@ if(${CONFIG_KERNEL_MEM_POOL})
   endif()
 endif()
 
+if(NOT CONFIG_MULTITHREADING)
+  message(WARNING "Single threaded mode (CONFIG_MULTITHREADING=n) is deprecated")
+endif()
+
 # The last 2 files inside the target_sources_ifdef should be
 # userspace_handler.c and userspace.c. If not the linker would complain.
 # This order has to be maintained. Any new file should be placed

kernel/Kconfig

@@ -10,9 +10,11 @@ module-str = kernel
 source "subsys/logging/Kconfig.template.log_config"
 
 config MULTITHREADING
-	bool "Multi-threading"
+	bool "Multi-threading (DEPRECATED)"
 	default y
 	help
+	  Disabling this option is DEPRECATED.
+
 	  If disabled, only the main thread is available, so a main() function
 	  must be provided. Interrupts are available. Kernel objects will most
 	  probably not behave as expected, especially with regards to pending,
@@ -23,6 +25,11 @@ config MULTITHREADING
 	  set to 'n'; disable only when you REALLY know what you are
 	  doing.
 
+if !MULTITHREADING
+comment "*** WARNING ***"
+comment "Single threaded mode (MULTITHREADING option disabled) is deprecated"
+endif
+
 config NUM_COOP_PRIORITIES
 	int "Number of coop priorities" if MULTITHREADING
 	default 1 if !MULTITHREADING

kernel/msg_q.c

@@ -113,7 +113,7 @@ int k_msgq_cleanup(struct k_msgq *msgq)
 }
 
 
-int z_impl_k_msgq_put(struct k_msgq *msgq, void *data, k_timeout_t timeout)
+int z_impl_k_msgq_put(struct k_msgq *msgq, const void *data, k_timeout_t timeout)
 {
 	__ASSERT(!arch_is_in_isr() || K_TIMEOUT_EQ(timeout, K_NO_WAIT), "");
 
@@ -150,7 +150,7 @@ int z_impl_k_msgq_put(struct k_msgq *msgq, void *data, k_timeout_t timeout)
 		result = -ENOMSG;
 	} else {
 		/* wait for put message success, failure, or timeout */
-		_current->base.swap_data = data;
+		_current->base.swap_data = (void *) data;
 		return z_pend_curr(&msgq->lock, key, &msgq->wait_q, timeout);
 	}
 
@@ -160,7 +160,7 @@ int z_impl_k_msgq_put(struct k_msgq *msgq, void *data, k_timeout_t timeout)
 }
 
 #ifdef CONFIG_USERSPACE
-static inline int z_vrfy_k_msgq_put(struct k_msgq *q, void *data,
+static inline int z_vrfy_k_msgq_put(struct k_msgq *q, const void *data,
 				    k_timeout_t timeout)
 {
 	Z_OOPS(Z_SYSCALL_OBJ(q, K_OBJ_MSGQ));

lib/gui/lvgl/lvgl.c

@@ -225,11 +225,21 @@ static bool lvgl_pointer_kscan_read(lv_indev_drv_t *drv, lv_indev_data_t *data)
 	}
 
 	if (IS_ENABLED(CONFIG_LVGL_POINTER_KSCAN_INVERT_X)) {
-		prev.point.x = cap.x_resolution - prev.point.x;
+		if (cap.current_orientation == DISPLAY_ORIENTATION_NORMAL ||
+		    cap.current_orientation == DISPLAY_ORIENTATION_ROTATED_180) {
+			prev.point.x = cap.x_resolution - prev.point.x;
+		} else {
+			prev.point.x = cap.y_resolution - prev.point.x;
+		}
 	}
 
 	if (IS_ENABLED(CONFIG_LVGL_POINTER_KSCAN_INVERT_Y)) {
-		prev.point.y = cap.y_resolution - prev.point.y;
+		if (cap.current_orientation == DISPLAY_ORIENTATION_NORMAL ||
+		    cap.current_orientation == DISPLAY_ORIENTATION_ROTATED_180) {
+			prev.point.y = cap.y_resolution - prev.point.y;
+		} else {
+			prev.point.y = cap.x_resolution - prev.point.y;
+		}
 	}
 
 	/* rotate touch point to match display rotation */
@@ -237,8 +247,8 @@ static bool lvgl_pointer_kscan_read(lv_indev_drv_t *drv, lv_indev_data_t *data)
 		lv_coord_t x;
 
 		x = prev.point.x;
-		prev.point.x = cap.y_resolution - prev.point.y;
-		prev.point.y = x;
+		prev.point.x = prev.point.y;
+		prev.point.y = cap.y_resolution - x;
 	} else if (cap.current_orientation == DISPLAY_ORIENTATION_ROTATED_180) {
 		prev.point.x = cap.x_resolution - prev.point.x;
 		prev.point.y = cap.y_resolution - prev.point.y;
@@ -246,8 +256,8 @@ static bool lvgl_pointer_kscan_read(lv_indev_drv_t *drv, lv_indev_data_t *data)
 		lv_coord_t x;
 
 		x = prev.point.x;
-		prev.point.x = prev.point.y;
-		prev.point.y = cap.x_resolution - x;
+		prev.point.x = cap.x_resolution - prev.point.y;
+		prev.point.y = x;
 	}
 
 	*data = prev;

modules/Kconfig.nordic

@@ -75,7 +75,6 @@ endmenu
 
 config HAS_NRFX
 	bool
-	select HAS_CMSIS_CORE
 
 menu "nrfx drivers"
 	depends on HAS_NRFX

modules/Kconfig.tfm

@@ -56,4 +56,16 @@ config TFM_BL2_FALSE
 
 endchoice
 
+if !TFM_BL2_FALSE
+
+config ROM_START_OFFSET
+	hex "ROM Start Offset accounting for BL2 Header in the NS image"
+	default 0x400
+	help
+	  By default BL2 header size in TF-M is 0x400. ROM_START_OFFSET
+	  needs to be updated if TF-M switches to use a different header
+	  size for BL2.
+
+endif # !TFM_BL2_FALSE
+
 endif # BUILD_WITH_TFM

samples/net/sockets/echo_client/boards/atsamr21_xpro.conf

@@ -10,16 +10,16 @@ CONFIG_NET_CONFIG_IEEE802154_DEV_NAME="RF2XX_0"
 # Reduced buffers to fit into SAMR21 SoC
 CONFIG_CPLUSPLUS=n
 
-CONFIG_NET_PKT_RX_COUNT=8
-CONFIG_NET_PKT_TX_COUNT=8
-CONFIG_NET_BUF_RX_COUNT=8
-CONFIG_NET_BUF_TX_COUNT=8
+CONFIG_NET_PKT_RX_COUNT=6
+CONFIG_NET_PKT_TX_COUNT=6
+CONFIG_NET_BUF_RX_COUNT=6
+CONFIG_NET_BUF_TX_COUNT=6
 CONFIG_NET_MAX_CONTEXTS=4
 CONFIG_NET_MAX_CONN=2
-CONFIG_NET_MAX_ROUTES=4
+CONFIG_NET_MAX_ROUTES=2
 CONFIG_NET_MAX_NEXTHOPS=2
 
 CONFIG_SHELL_STACK_SIZE=768
 CONFIG_SHELL_CMD_BUFF_SIZE=80
 CONFIG_SHELL_ARGC_MAX=6
-CONFIG_SHELL_HISTORY_BUFFER=128
+CONFIG_SHELL_HISTORY_BUFFER=64

samples/net/sockets/echo_server/boards/atsamr21_xpro.conf

@@ -10,16 +10,16 @@ CONFIG_NET_CONFIG_IEEE802154_DEV_NAME="RF2XX_0"
 # Reduced buffers to fit into SAMR21 SoC
 CONFIG_CPLUSPLUS=n
 
-CONFIG_NET_PKT_RX_COUNT=8
-CONFIG_NET_PKT_TX_COUNT=8
-CONFIG_NET_BUF_RX_COUNT=8
-CONFIG_NET_BUF_TX_COUNT=8
+CONFIG_NET_PKT_RX_COUNT=6
+CONFIG_NET_PKT_TX_COUNT=6
+CONFIG_NET_BUF_RX_COUNT=6
+CONFIG_NET_BUF_TX_COUNT=6
 CONFIG_NET_MAX_CONTEXTS=4
 CONFIG_NET_MAX_CONN=2
-CONFIG_NET_MAX_ROUTES=4
+CONFIG_NET_MAX_ROUTES=2
 CONFIG_NET_MAX_NEXTHOPS=2
 
 CONFIG_SHELL_STACK_SIZE=768
 CONFIG_SHELL_CMD_BUFF_SIZE=80
 CONFIG_SHELL_ARGC_MAX=6
-CONFIG_SHELL_HISTORY_BUFFER=128
+CONFIG_SHELL_HISTORY_BUFFER=64

samples/portability/cmsis_rtos_v1/philosophers/sample.yaml

@@ -5,7 +5,10 @@ common:
   tags: cmsis_rtos
   min_ram: 32
   min_flash: 34
-  platform_exclude: qemu_xtensa qemu_x86_64
+  # qemu_x86_64 and up_squared need bigger stack
+  # but CMSIS limits the stack size, resulting
+  # in stack overflow.
+  platform_exclude: qemu_xtensa qemu_x86_64 up_squared
   harness: console
   harness_config:
     type: multi_line

samples/subsys/tracing/src/tracing_string_format_test.c

@@ -10,115 +10,121 @@
 
 void sys_trace_thread_switched_out(void)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	struct k_thread *thread;
+
+	thread = k_current_get();
+	TRACING_STRING("%s: %p\n", __func__, thread);
 }
 
 void sys_trace_thread_switched_in(void)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	struct k_thread *thread;
+
+	thread = k_current_get();
+	TRACING_STRING("%s: %p\n", __func__, thread);
 }
 
 void sys_trace_thread_priority_set(struct k_thread *thread)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s: %p\n", __func__, thread);
 }
 
 void sys_trace_thread_create(struct k_thread *thread)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s: %p\n", __func__, thread);
 }
 
 void sys_trace_thread_abort(struct k_thread *thread)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s: %p\n", __func__, thread);
 }
 
 void sys_trace_thread_suspend(struct k_thread *thread)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s: %p\n", __func__, thread);
 }
 
 void sys_trace_thread_resume(struct k_thread *thread)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s: %p\n", __func__, thread);
 }
 
 void sys_trace_thread_ready(struct k_thread *thread)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s: %p\n", __func__, thread);
 }
 
 void sys_trace_thread_pend(struct k_thread *thread)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s: %p\n", __func__, thread);
 }
 
 void sys_trace_thread_info(struct k_thread *thread)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s: %p\n", __func__, thread);
 }
 
 void sys_trace_thread_name_set(struct k_thread *thread)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s: %p\n", __func__, thread);
 }
 
 void sys_trace_isr_enter(void)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s\n", __func__);
 }
 
 void sys_trace_isr_exit(void)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s\n", __func__);
 }
 
 void sys_trace_isr_exit_to_scheduler(void)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s\n", __func__);
 }
 
 void sys_trace_idle(void)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s\n", __func__);
 }
 
 void sys_trace_void(unsigned int id)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s: %d\n", __func__, id);
 }
 
 void sys_trace_end_call(unsigned int id)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s: %d\n", __func__, id);
 }
 
 void sys_trace_semaphore_init(struct k_sem *sem)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s: %p\n", __func__, sem);
 }
 
 void sys_trace_semaphore_take(struct k_sem *sem)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s: %p\n", __func__, sem);
 }
 
 void sys_trace_semaphore_give(struct k_sem *sem)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s: %p\n", __func__, sem);
 }
 
 void sys_trace_mutex_init(struct k_mutex *mutex)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s: %p\n", __func__, mutex);
 }
 
 void sys_trace_mutex_lock(struct k_mutex *mutex)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s: %p\n", __func__, mutex);
 }
 
 void sys_trace_mutex_unlock(struct k_mutex *mutex)
 {
-	TRACING_STRING("%s %d\n", __func__, __LINE__);
+	TRACING_STRING("%s: %p\n", __func__, mutex);
 }

samples/synchronization/src/main.c

@@ -43,12 +43,12 @@ void helloLoop(const char *my_name,
 
 		/* say "hello" */
 		tname = k_thread_name_get(k_current_get());
-		if (tname == NULL) {
-			printk("%s: Hello World from %s!\n",
-				my_name, CONFIG_BOARD);
-		} else {
+		if (tname != NULL && tname[0] != '\0') {
 			printk("%s: Hello World from %s!\n",
 				tname, CONFIG_BOARD);
+		} else {
+			printk("%s: Hello World from %s!\n",
+				my_name, CONFIG_BOARD);
 		}
 
 		/* wait a while, then let other thread have a turn */

soc/arm/arm/mps2/soc.c

@@ -11,6 +11,7 @@
 #include <drivers/gpio/gpio_mmio32.h>
 #include <init.h>
 #include <soc.h>
+#include <linker/linker-defs.h>
 
 
 /* Setup GPIO drivers for accessing FPGAIO registers */
@@ -43,11 +44,6 @@ FPGAIO_INIT(2);
  */
 #define CPU1_FLASH_OFFSET       (0x10000000)
 
-/* Space reserved for TF-M's secure bootloader on the secondary mcu.
- * This space is reserved whether BL2 is used or not.
- */
-#define BL2_HEADER_SIZE         (0x400)
-
 /**
  * @brief Wake up CPU 1 from another CPU, this is plaform specific.
  */
@@ -55,8 +51,7 @@ void wakeup_cpu1(void)
 {
 	/* Set the Initial Secure Reset Vector Register for CPU 1 */
 	*(uint32_t *)(SSE_200_SYSTEM_CTRL_INITSVTOR1) =
-		CONFIG_FLASH_BASE_ADDRESS +
-		BL2_HEADER_SIZE +
+		(uint32_t)_vector_start +
 		CPU1_FLASH_ADDRESS -
 		CPU1_FLASH_OFFSET;
 

soc/arm/arm/musca_b1/soc.c

@@ -7,6 +7,7 @@
 #include <arch/cpu.h>
 #include <init.h>
 #include <soc.h>
+#include <linker/linker-defs.h>
 
 /* (Secure System Control) Base Address */
 #define SSE_200_SYSTEM_CTRL_S_BASE	(0x50021000UL)
@@ -26,8 +27,7 @@ void wakeup_cpu1(void)
 {
 	/* Set the Initial Secure Reset Vector Register for CPU 1 */
 	*(uint32_t *)(SSE_200_SYSTEM_CTRL_INITSVTOR1) =
-					CONFIG_FLASH_BASE_ADDRESS +
-					BL2_HEADER_SIZE +
+					(uint32_t)_vector_start +
 					NON_SECURE_FLASH_ADDRESS -
 					NON_SECURE_FLASH_OFFSET;
 

soc/arm/st_stm32/stm32f0/soc.c

@@ -16,6 +16,9 @@
 #include <linker/linker-defs.h>
 #include <string.h>
 
+#if defined(CONFIG_SW_VECTOR_RELAY) || defined(CONFIG_SW_VECTOR_RELAY_CLIENT)
+extern void *_vector_table_pointer;
+#endif
 
 /**
  * @brief Relocate vector table to SRAM.
@@ -29,6 +32,11 @@
  * A zephyr image that is a bootloader does not have to relocate the
  * vector table.
  *
+ * Alternatively both switches SW_VECTOR_RELAY (for Bootloader image) and
+ * SW_VECTOR_RELAY_CLIENT (for image loaded by a bootloader) can be used to
+ * adds a vector table relay handler and a vector relay table, to relay
+ * interrupts based on a vector table pointer.
+ *
  * Replaces the default function from prep_c.c.
  *
  * @note Zephyr applications that will not be loaded by a bootloader should
@@ -36,7 +44,9 @@
  */
 void relocate_vector_table(void)
 {
-#ifndef CONFIG_IS_BOOTLOADER
+#if defined(CONFIG_SW_VECTOR_RELAY) || defined(CONFIG_SW_VECTOR_RELAY_CLIENT)
+	_vector_table_pointer = _vector_start;
+#elif !defined(CONFIG_IS_BOOTLOADER)
 	extern char _ram_vector_start[];
 
 	size_t vector_size = (size_t)_vector_end - (size_t)_vector_start;

soc/arm/st_stm32/stm32l4/power.c

@@ -93,6 +93,7 @@ void _sys_pm_power_state_exit_post_ops(enum power_states state)
 	case SYS_POWER_STATE_SLEEP_3:
 #endif /* CONFIG_HAS_SYS_POWER_STATE_SLEEP_3 */
 		LL_LPM_DisableSleepOnExit();
+		LL_LPM_EnableSleep();
 		break;
 #endif /* CONFIG_SYS_POWER_SLEEP_STATES */
 	default:

soc/arm/st_stm32/stm32wb/power.c

@@ -93,6 +93,7 @@ void _sys_pm_power_state_exit_post_ops(enum power_states state)
 	case SYS_POWER_STATE_SLEEP_3:
 #endif /* CONFIG_HAS_SYS_POWER_STATE_SLEEP_3 */
 		LL_LPM_DisableSleepOnExit();
+		LL_LPM_EnableSleep();
 		break;
 #endif /* CONFIG_SYS_POWER_SLEEP_STATES */
 	default:

subsys/bluetooth/controller/ll_sw/nordic/hal/nrf5/radio/radio.c

@@ -293,11 +293,45 @@ uint32_t radio_rx_chain_delay_get(uint8_t phy, uint8_t flags)
 
 void radio_rx_enable(void)
 {
+#if !defined(CONFIG_BT_CTLR_TIFS_HW)
+#if defined(CONFIG_SOC_SERIES_NRF53X)
+	/* NOTE: Timer clear DPPI configuration is needed only for nRF53
+	 *       because of calls to radio_disable() and
+	 *       radio_switch_complete_and_disable() inside a radio event call
+	 *       hal_radio_sw_switch_disable(), which in the case of nRF53
+	 *       cancels the task subscription.
+	 */
+	/* FIXME: hal_sw_switch_timer_clear_ppi_config() sets both task and
+	 *        event. Consider a new interface to only set the task, or
+	 *        change the design to not clear task subscription inside a
+	 *        radio event but when the radio event is done.
+	 */
+	hal_sw_switch_timer_clear_ppi_config();
+#endif /* CONFIG_SOC_SERIES_NRF53X */
+#endif /* !CONFIG_BT_CTLR_TIFS_HW */
+
 	nrf_radio_task_trigger(NRF_RADIO, NRF_RADIO_TASK_RXEN);
 }
 
 void radio_tx_enable(void)
 {
+#if !defined(CONFIG_BT_CTLR_TIFS_HW)
+#if defined(CONFIG_SOC_SERIES_NRF53X)
+	/* NOTE: Timer clear DPPI configuration is needed only for nRF53
+	 *       because of calls to radio_disable() and
+	 *       radio_switch_complete_and_disable() inside a radio event call
+	 *       hal_radio_sw_switch_disable(), which in the case of nRF53
+	 *       cancels the task subscription.
+	 */
+	/* FIXME: hal_sw_switch_timer_clear_ppi_config() sets both task and
+	 *        event. Consider a new interface to only set the task, or
+	 *        change the design to not clear task subscription inside a
+	 *        radio event but when the radio event is done.
+	 */
+	hal_sw_switch_timer_clear_ppi_config();
+#endif /* CONFIG_SOC_SERIES_NRF53X */
+#endif /* !CONFIG_BT_CTLR_TIFS_HW */
+
 	nrf_radio_task_trigger(NRF_RADIO, NRF_RADIO_TASK_TXEN);
 }
 
@@ -739,6 +773,20 @@ uint32_t radio_tmr_start_tick(uint8_t trx, uint32_t tick)
 #if defined(CONFIG_BT_CTLR_SW_SWITCH_SINGLE_TIMER)
 	last_pdu_end_us = 0U;
 #endif /* CONFIG_BT_CTLR_SW_SWITCH_SINGLE_TIMER */
+#if defined(CONFIG_SOC_SERIES_NRF53X)
+	/* NOTE: Timer clear DPPI configuration is needed only for nRF53
+	 *       because of calls to radio_disable() and
+	 *       radio_switch_complete_and_disable() inside a radio event call
+	 *       hal_radio_sw_switch_disable(), which in the case of nRF53
+	 *       cancels the task subscription.
+	 */
+	/* FIXME: hal_sw_switch_timer_clear_ppi_config() sets both task and
+	 *        event. Consider a new interface to only set the task, or
+	 *        change the design to not clear task subscription inside a
+	 *        radio event but when the radio event is done.
+	 */
+	hal_sw_switch_timer_clear_ppi_config();
+#endif /* CONFIG_SOC_SERIES_NRF53X */
 #endif /* !CONFIG_BT_CTLR_TIFS_HW */
 
 	return remainder_us;
@@ -757,6 +805,23 @@ uint32_t radio_tmr_start_now(uint8_t trx)
 
 	hal_radio_enable_on_tick_ppi_config_and_enable(trx);
 
+#if !defined(CONFIG_BT_CTLR_TIFS_HW)
+#if defined(CONFIG_SOC_SERIES_NRF53X)
+	/* NOTE: Timer clear DPPI configuration is needed only for nRF53
+	 *       because of calls to radio_disable() and
+	 *       radio_switch_complete_and_disable() inside a radio event call
+	 *       hal_radio_sw_switch_disable(), which in the case of nRF53
+	 *       cancels the task subscription.
+	 */
+	/* FIXME: hal_sw_switch_timer_clear_ppi_config() sets both task and
+	 *        event. Consider a new interface to only set the task, or
+	 *        change the design to not clear task subscription inside a
+	 *        radio event but when the radio event is done.
+	 */
+	hal_sw_switch_timer_clear_ppi_config();
+#endif /* CONFIG_SOC_SERIES_NRF53X */
+#endif /* !CONFIG_BT_CTLR_TIFS_HW */
+
 	/* Capture the current time */
 	nrf_timer_task_trigger(EVENT_TIMER, NRF_TIMER_TASK_CAPTURE1);
 	now = EVENT_TIMER->CC[1];

subsys/bluetooth/controller/ll_sw/nordic/lll/lll_conn.c

@@ -37,8 +37,9 @@
 
 static int init_reset(void);
 static void isr_done(void *param);
-static int isr_rx_pdu(struct lll_conn *lll, struct pdu_data *pdu_data_rx,
-		      struct node_tx **tx_release, uint8_t *is_rx_enqueue);
+static inline int isr_rx_pdu(struct lll_conn *lll, struct pdu_data *pdu_data_rx,
+			     uint8_t *is_rx_enqueue,
+			     struct node_tx **tx_release, uint8_t *is_done);
 static struct pdu_data *empty_tx_enqueue(struct lll_conn *lll);
 
 static uint16_t const sca_ppm_lut[] = {500, 250, 150, 100, 75, 50, 30, 20};
@@ -132,12 +133,11 @@ void lll_conn_isr_rx(void *param)
 	struct pdu_data *pdu_data_tx;
 	struct node_rx_pdu *node_rx;
 	uint8_t is_empty_pdu_tx_retry;
-	uint8_t is_crc_backoff = 0U;
 	uint8_t is_rx_enqueue = 0U;
 	uint8_t is_ull_rx = 0U;
+	uint8_t is_done = 0U;
 	uint8_t rssi_ready;
 	uint8_t trx_done;
-	uint8_t is_done;
 	uint8_t crc_ok;
 
 #if defined(CONFIG_BT_CTLR_PROFILE_ISR)
@@ -174,7 +174,8 @@ void lll_conn_isr_rx(void *param)
 	if (crc_ok) {
 		uint32_t err;
 
-		err = isr_rx_pdu(lll, pdu_data_rx, &tx_release, &is_rx_enqueue);
+		err = isr_rx_pdu(lll, pdu_data_rx, &is_rx_enqueue, &tx_release,
+				 &is_done);
 		if (err) {
 			goto lll_conn_isr_rx_exit;
 		}
@@ -192,7 +193,7 @@ void lll_conn_isr_rx(void *param)
 
 		/* CRC error countdown */
 		crc_expire--;
-		is_crc_backoff = (crc_expire == 0U);
+		is_done = (crc_expire == 0U);
 	}
 
 	/* prepare tx packet */
@@ -200,8 +201,8 @@ void lll_conn_isr_rx(void *param)
 	lll_conn_pdu_tx_prep(lll, &pdu_data_tx);
 
 	/* Decide on event continuation and hence Radio Shorts to use */
-	is_done = is_crc_backoff || ((crc_ok) && (pdu_data_rx->md == 0) &&
-				     (pdu_data_tx->len == 0));
+	is_done = is_done || ((crc_ok) && (pdu_data_rx->md == 0) &&
+			      (pdu_data_tx->len == 0));
 
 	if (is_done) {
 		radio_isr_set(isr_done, param);
@@ -607,8 +608,9 @@ static inline bool ctrl_pdu_len_check(uint8_t len)
 
 }
 
-static int isr_rx_pdu(struct lll_conn *lll, struct pdu_data *pdu_data_rx,
-		      struct node_tx **tx_release, uint8_t *is_rx_enqueue)
+static inline int isr_rx_pdu(struct lll_conn *lll, struct pdu_data *pdu_data_rx,
+			     uint8_t *is_rx_enqueue,
+			     struct node_tx **tx_release, uint8_t *is_done)
 {
 #if defined(CONFIG_SOC_COMPATIBLE_NRF52832) && \
 	defined(CONFIG_BT_CTLR_LE_ENC) && \
@@ -625,10 +627,11 @@ static int isr_rx_pdu(struct lll_conn *lll, struct pdu_data *pdu_data_rx,
 
 	/* Ack for tx-ed data */
 	if (pdu_data_rx->nesn != lll->sn) {
+		struct pdu_data *pdu_data_tx;
 		struct node_tx *tx;
 		memq_link_t *link;
 
-		/* Increment serial number */
+		/* Increment sequence number */
 		lll->sn++;
 
 #if defined(CONFIG_BT_PERIPHERAL)
@@ -645,11 +648,16 @@ static int isr_rx_pdu(struct lll_conn *lll, struct pdu_data *pdu_data_rx,
 					 (void **)&tx);
 		} else {
 			lll->empty = 0;
+
+			pdu_data_tx = (void *)radio_pkt_empty_get();
+			if (IS_ENABLED(CONFIG_BT_CENTRAL) && !lll->role) {
+				*is_done = !pdu_data_tx->md;
+			}
+
 			link = NULL;
 		}
 
 		if (link) {
-			struct pdu_data *pdu_data_tx;
 			uint8_t pdu_data_tx_len;
 			uint8_t offset;
 
@@ -684,6 +692,10 @@ static int isr_rx_pdu(struct lll_conn *lll, struct pdu_data *pdu_data_rx,
 
 				*tx_release = tx;
 			}
+
+			if (IS_ENABLED(CONFIG_BT_CENTRAL) && !lll->role) {
+				*is_done = !pdu_data_tx->md;
+			}
 		}
 	}
 

subsys/bluetooth/controller/ll_sw/ull.c

@@ -110,7 +110,7 @@
 #define BT_CONN_TICKER_NODES 0
 #endif
 
-#if defined(CONFIG_SOC_FLASH_NRF_RADIO_SYNC)
+#if defined(CONFIG_SOC_FLASH_NRF_RADIO_SYNC_TICKER)
 #define FLASH_TICKER_NODES        2 /* No. of tickers reserved for flashing */
 #define FLASH_TICKER_USER_APP_OPS 1 /* No. of additional ticker operations */
 #else

subsys/bluetooth/controller/ll_sw/ull_adv.c

@@ -1839,7 +1839,7 @@ static inline uint8_t disable(uint8_t handle)
 				  ull_ticker_status_give, (void *)&ret_cb);
 		ret = ull_ticker_status_take(ret, &ret_cb);
 		if (ret) {
-			mark = ull_disable_mark(adv);
+			mark = ull_disable_unmark(adv);
 			LL_ASSERT(mark == adv);
 
 			return BT_HCI_ERR_CMD_DISALLOWED;
@@ -1853,7 +1853,7 @@ static inline uint8_t disable(uint8_t handle)
 			  ull_ticker_status_give, (void *)&ret_cb);
 	ret = ull_ticker_status_take(ret, &ret_cb);
 	if (ret) {
-		mark = ull_disable_mark(adv);
+		mark = ull_disable_unmark(adv);
 		LL_ASSERT(mark == adv);
 
 		return BT_HCI_ERR_CMD_DISALLOWED;

subsys/bluetooth/controller/ll_sw/ull_conn.c

@@ -4374,13 +4374,8 @@ static inline int reject_ind_phy_upd_recv(struct ll_conn *conn,
 #endif /* CONFIG_BT_CTLR_PHY */
 
 #if defined(CONFIG_BT_CTLR_LE_ENC)
-static inline int reject_ind_enc_recv(struct ll_conn *conn,
-				      struct pdu_data *pdu_rx)
+static inline int reject_ind_enc_recv(struct ll_conn *conn)
 {
-	struct pdu_data_llctrl_reject_ext_ind *rej_ext_ind;
-
-	rej_ext_ind = (void *)&pdu_rx->llctrl.reject_ext_ind;
-
 	/* resume data packet rx and tx */
 	conn->llcp_enc.pause_rx = 0U;
 	conn->llcp_enc.pause_tx = 0U;
@@ -4389,7 +4384,18 @@ static inline int reject_ind_enc_recv(struct ll_conn *conn,
 	conn->llcp_ack = conn->llcp_req;
 	conn->procedure_expire = 0U;
 
+	return 0;
+}
+
+static inline int reject_ext_ind_enc_recv(struct ll_conn *conn,
+					  struct pdu_data *pdu_rx)
+{
+	struct pdu_data_llctrl_reject_ext_ind *rej_ext_ind;
+
+	reject_ind_enc_recv(conn);
+
 	/* enqueue as if it were a reject ind */
+	rej_ext_ind = (void *)&pdu_rx->llctrl.reject_ext_ind;
 	pdu_rx->llctrl.opcode = PDU_DATA_LLCTRL_TYPE_REJECT_IND;
 	pdu_rx->llctrl.reject_ind.error_code = rej_ext_ind->error_code;
 
@@ -4397,6 +4403,64 @@ static inline int reject_ind_enc_recv(struct ll_conn *conn,
 }
 #endif /* CONFIG_BT_CTLR_LE_ENC */
 
+static inline void reject_ind_recv(struct ll_conn *conn, struct node_rx_pdu *rx,
+				   struct pdu_data *pdu_rx)
+{
+	int err = -EINVAL;
+
+
+	if (0) {
+
+#if defined(CONFIG_BT_CTLR_LE_ENC)
+	} else if ((conn->llcp_ack != conn->llcp_req) &&
+		   (conn->llcp_type == LLCP_ENCRYPTION)) {
+		err = reject_ind_enc_recv(conn);
+#endif /* CONFIG_BT_CTLR_LE_ENC */
+
+#if defined(CONFIG_BT_CTLR_PHY)
+	} else if (conn->llcp_phy.ack != conn->llcp_phy.req) {
+		struct pdu_data_llctrl_reject_ext_ind *rej_ext_ind;
+		struct pdu_data_llctrl_reject_ind *rej_ind;
+
+		rej_ext_ind = (void *)&pdu_rx->llctrl.reject_ext_ind;
+		rej_ind = (void *)&pdu_rx->llctrl.reject_ind;
+		/* NOTE: Do not modify reject_opcode field which overlap with
+		 *       error_code field in reject ind PDU structure. Only copy
+		 *       error_code from reject ind to reject ext ind PDU
+		 *       structure.
+		 */
+		rej_ext_ind->error_code = rej_ind->error_code;
+		err = reject_ind_phy_upd_recv(conn, rx, pdu_rx);
+#endif /* CONFIG_BT_CTLR_PHY */
+
+#if defined(CONFIG_BT_CTLR_CONN_PARAM_REQ)
+	} else if (conn->llcp_conn_param.ack != conn->llcp_conn_param.req) {
+		struct pdu_data_llctrl_reject_ext_ind *rej_ext_ind;
+		struct pdu_data_llctrl_reject_ind *rej_ind;
+
+		rej_ext_ind = (void *)&pdu_rx->llctrl.reject_ext_ind;
+		rej_ind = (void *)&pdu_rx->llctrl.reject_ind;
+		/* NOTE: Do not modify reject_opcode field which overlap with
+		 *       error_code field in reject ind PDU structure. Only copy
+		 *       error_code from reject ind to reject ext ind PDU
+		 *       structure.
+		 */
+		rej_ext_ind->error_code = rej_ind->error_code;
+		err = reject_ind_conn_upd_recv(conn, rx, pdu_rx);
+#endif /* CONFIG_BT_CTLR_CONN_PARAM_REQ */
+
+#if defined(CONFIG_BT_CTLR_DATA_LENGTH)
+	} else if (conn->llcp_length.ack != conn->llcp_length.req) {
+		err = reject_ind_dle_recv(conn, pdu_rx);
+#endif /* CONFIG_BT_CTLR_DATA_LENGTH */
+	}
+
+	if (err) {
+		/* Mark for buffer for release */
+		rx->hdr.type = NODE_RX_TYPE_DC_PDU_RELEASE;
+	}
+}
+
 static inline void reject_ext_ind_recv(struct ll_conn *conn,
 				       struct node_rx_pdu *rx,
 				       struct pdu_data *pdu_rx)
@@ -4411,7 +4475,7 @@ static inline void reject_ext_ind_recv(struct ll_conn *conn,
 	case PDU_DATA_LLCTRL_TYPE_ENC_REQ:
 		if ((conn->llcp_ack != conn->llcp_req) &&
 		    (conn->llcp_type == LLCP_ENCRYPTION)) {
-			err = reject_ind_enc_recv(conn, pdu_rx);
+			err = reject_ext_ind_enc_recv(conn, pdu_rx);
 		}
 		break;
 #endif /* CONFIG_BT_CTLR_LE_ENC */
@@ -5473,13 +5537,7 @@ static inline int ctrl_rx(memq_link_t *link, struct node_rx_pdu **rx,
 			goto ull_conn_rx_unknown_rsp_send;
 		}
 
-		/* resume data packet rx and tx */
-		conn->llcp_enc.pause_rx = 0U;
-		conn->llcp_enc.pause_tx = 0U;
-
-		/* Procedure complete */
-		conn->llcp_ack = conn->llcp_req;
-		conn->procedure_expire = 0U;
+		reject_ind_recv(conn, *rx, pdu_rx);
 		break;
 #endif /* CONFIG_BT_CTLR_LE_ENC */
 

subsys/bluetooth/host/gatt.c

@@ -1699,6 +1699,8 @@ ssize_t bt_gatt_attr_read_cpf(struct bt_conn *conn,
 }
 
 struct notify_data {
+	const struct bt_gatt_attr *attr;
+	uint16_t handle;
 	int err;
 	uint16_t type;
 	union {
@@ -2012,10 +2014,16 @@ static uint8_t notify_cb(const struct bt_gatt_attr *attr, uint16_t handle,
 			continue;
 		}
 
+		/* Use the Characteristic Value handle discovered since the
+		 * Client Characteristic Configuration descriptor may occur
+		 * in any position within the characteristic definition after
+		 * the Characteristic Value.
+		 */
 		if (data->type == BT_GATT_CCC_INDICATE) {
-			err = gatt_indicate(conn, handle - 1, data->ind_params);
+			err = gatt_indicate(conn, data->handle,
+					    data->ind_params);
 		} else {
-			err = gatt_notify(conn, handle - 1, data->nfy_params);
+			err = gatt_notify(conn, data->handle, data->nfy_params);
 		}
 
 		bt_conn_unref(conn);
@@ -2030,23 +2038,18 @@ static uint8_t notify_cb(const struct bt_gatt_attr *attr, uint16_t handle,
 	return BT_GATT_ITER_CONTINUE;
 }
 
-struct find_data {
-	const struct bt_gatt_attr *attr;
-	uint16_t handle;
-};
-
 static uint8_t match_uuid(const struct bt_gatt_attr *attr, uint16_t handle,
 			  void *user_data)
 {
-	struct find_data *found = user_data;
+	struct notify_data *data = user_data;
 
-	found->attr = attr;
-	found->handle = handle;
+	data->attr = attr;
+	data->handle = handle;
 
 	return BT_GATT_ITER_STOP;
 }
 
-static bool gatt_find_by_uuid(struct find_data *found,
+static bool gatt_find_by_uuid(struct notify_data *found,
 			      const struct bt_uuid *uuid)
 {
 	found->attr = NULL;
@@ -2061,7 +2064,6 @@ int bt_gatt_notify_cb(struct bt_conn *conn,
 		      struct bt_gatt_notify_params *params)
 {
 	struct notify_data data;
-	struct find_data found;
 
 	__ASSERT(params, "invalid parameters\n");
 	__ASSERT(params->attr, "invalid parameters\n");
@@ -2070,44 +2072,44 @@ int bt_gatt_notify_cb(struct bt_conn *conn,
 		return -EAGAIN;
 	}
 
-	found.attr = params->attr;
+	data.attr = params->attr;
 
 	if (conn && conn->state != BT_CONN_CONNECTED) {
 		return -ENOTCONN;
 	}
 
-	found.handle = bt_gatt_attr_get_handle(found.attr);
-	if (!found.handle) {
+	data.handle = bt_gatt_attr_get_handle(data.attr);
+	if (!data.handle) {
 		return -ENOENT;
 	}
 
 	/* Lookup UUID if it was given */
 	if (params->uuid) {
-		if (!gatt_find_by_uuid(&found, params->uuid)) {
+		if (!gatt_find_by_uuid(&data, params->uuid)) {
 			return -ENOENT;
 		}
 	}
 
 	/* Check if attribute is a characteristic then adjust the handle */
-	if (!bt_uuid_cmp(found.attr->uuid, BT_UUID_GATT_CHRC)) {
-		struct bt_gatt_chrc *chrc = found.attr->user_data;
+	if (!bt_uuid_cmp(data.attr->uuid, BT_UUID_GATT_CHRC)) {
+		struct bt_gatt_chrc *chrc = data.attr->user_data;
 
 		if (!(chrc->properties & BT_GATT_CHRC_NOTIFY)) {
 			return -EINVAL;
 		}
 
-		found.handle = bt_gatt_attr_value_handle(found.attr);
+		data.handle = bt_gatt_attr_value_handle(data.attr);
 	}
 
 	if (conn) {
-		return gatt_notify(conn, found.handle, params);
+		return gatt_notify(conn, data.handle, params);
 	}
 
 	data.err = -ENOTCONN;
 	data.type = BT_GATT_CCC_NOTIFY;
 	data.nfy_params = params;
 
-	bt_gatt_foreach_attr_type(found.handle, 0xffff, BT_UUID_GATT_CCC, NULL,
+	bt_gatt_foreach_attr_type(data.handle, 0xffff, BT_UUID_GATT_CCC, NULL,
 				  1, notify_cb, &data);
 
 	return data.err;
@@ -2138,7 +2140,6 @@ int bt_gatt_indicate(struct bt_conn *conn,
 		     struct bt_gatt_indicate_params *params)
 {
 	struct notify_data data;
-	struct find_data found;
 
 	__ASSERT(params, "invalid parameters\n");
 	__ASSERT(params->attr, "invalid parameters\n");
@@ -2147,44 +2148,44 @@ int bt_gatt_indicate(struct bt_conn *conn,
 		return -EAGAIN;
 	}
 
-	found.attr = params->attr;
+	data.attr = params->attr;
 
 	if (conn && conn->state != BT_CONN_CONNECTED) {
 		return -ENOTCONN;
 	}
 
-	found.handle = bt_gatt_attr_get_handle(found.attr);
-	if (!found.handle) {
+	data.handle = bt_gatt_attr_get_handle(data.attr);
+	if (!data.handle) {
 		return -ENOENT;
 	}
 
 	/* Lookup UUID if it was given */
 	if (params->uuid) {
-		if (!gatt_find_by_uuid(&found, params->uuid)) {
+		if (!gatt_find_by_uuid(&data, params->uuid)) {
 			return -ENOENT;
 		}
 	}
 
 	/* Check if attribute is a characteristic then adjust the handle */
-	if (!bt_uuid_cmp(found.attr->uuid, BT_UUID_GATT_CHRC)) {
-		struct bt_gatt_chrc *chrc = found.attr->user_data;
+	if (!bt_uuid_cmp(data.attr->uuid, BT_UUID_GATT_CHRC)) {
+		struct bt_gatt_chrc *chrc = data.attr->user_data;
 
 		if (!(chrc->properties & BT_GATT_CHRC_INDICATE)) {
 			return -EINVAL;
 		}
 
-		found.handle = bt_gatt_attr_value_handle(found.attr);
+		data.handle = bt_gatt_attr_value_handle(data.attr);
 	}
 
 	if (conn) {
-		return gatt_indicate(conn, found.handle, params);
+		return gatt_indicate(conn, data.handle, params);
 	}
 
 	data.err = -ENOTCONN;
 	data.type = BT_GATT_CCC_INDICATE;
 	data.ind_params = params;
 
-	bt_gatt_foreach_attr_type(found.handle, 0xffff, BT_UUID_GATT_CCC, NULL,
+	bt_gatt_foreach_attr_type(data.handle, 0xffff, BT_UUID_GATT_CCC, NULL,
 				  1, notify_cb, &data);
 
 	return data.err;

subsys/bluetooth/host/hci_core.c

@@ -4647,10 +4647,43 @@ static void le_per_adv_sync_established(struct net_buf *buf)
 	struct bt_le_per_adv_sync *pending_per_adv_sync;
 	int err;
 
-	err = bt_le_scan_update(false);
+	pending_per_adv_sync = get_pending_per_adv_sync();
 
-	if (err) {
-		BT_ERR("Could not stop scan (%d)", err);
+	if (pending_per_adv_sync) {
+		atomic_clear_bit(pending_per_adv_sync->flags,
+				 BT_PER_ADV_SYNC_SYNCING);
+		err = bt_le_scan_update(false);
+
+		if (err) {
+			BT_ERR("Could not update scan (%d)", err);
+		}
+	}
+
+	if (!pending_per_adv_sync ||
+	    pending_per_adv_sync->sid != evt->sid ||
+	    bt_addr_le_cmp(&pending_per_adv_sync->addr, &evt->adv_addr)) {
+		struct bt_le_per_adv_sync_term_info term_info;
+
+		BT_ERR("Unexpected per adv sync established event");
+		per_adv_sync_terminate(sys_le16_to_cpu(evt->handle));
+
+		if (pending_per_adv_sync) {
+			/* Terminate the pending PA sync and notify app */
+			term_info.addr = &pending_per_adv_sync->addr;
+			term_info.sid = pending_per_adv_sync->sid;
+
+			/* Deleting before callback, so the caller will be able
+			 * to restart sync in the callback.
+			 */
+			per_adv_sync_delete(pending_per_adv_sync);
+
+			if (pending_per_adv_sync->cb &&
+			    pending_per_adv_sync->cb->term) {
+				pending_per_adv_sync->cb->term(
+					pending_per_adv_sync, &term_info);
+			}
+		}
+		return;
 	}
 
 	if (evt->status == BT_HCI_ERR_OP_CANCELLED_BY_HOST) {
@@ -4658,18 +4691,6 @@ static void le_per_adv_sync_established(struct net_buf *buf)
 		return;
 	}
 
-	pending_per_adv_sync = get_pending_per_adv_sync();
-
-	if (!pending_per_adv_sync ||
-	    pending_per_adv_sync->sid != evt->sid ||
-	    bt_addr_le_cmp(&pending_per_adv_sync->addr, &evt->adv_addr)) {
-		BT_ERR("Unexpected per adv sync established event");
-		per_adv_sync_terminate(sys_le16_to_cpu(evt->handle));
-		return;
-	}
-
-	atomic_clear_bit(pending_per_adv_sync->flags, BT_PER_ADV_SYNC_SYNCING);
-
 	atomic_set_bit(pending_per_adv_sync->flags, BT_PER_ADV_SYNC_SYNCED);
 
 	pending_per_adv_sync->handle = sys_le16_to_cpu(evt->handle);
@@ -6702,7 +6723,7 @@ int bt_set_name(const char *name)
 	size_t len = strlen(name);
 	int err;
 
-	if (len >= sizeof(bt_dev.name)) {
+	if (len > CONFIG_BT_DEVICE_NAME_MAX) {
 		return -ENOMEM;
 	}
 
@@ -6710,12 +6731,13 @@ int bt_set_name(const char *name)
 		return 0;
 	}
 
-	strncpy(bt_dev.name, name, sizeof(bt_dev.name));
+	strncpy(bt_dev.name, name, len);
+	bt_dev.name[len] = '\0';
 
 	/* Update advertising name if in use */
 	if (adv && atomic_test_bit(adv->flags, BT_ADV_INCLUDE_NAME)) {
 		struct bt_data data[] = { BT_DATA(BT_DATA_NAME_COMPLETE, name,
-						strlen(name)) };
+						len) };
 		struct bt_ad sd = { data, ARRAY_SIZE(data) };
 
 		set_sd(adv, &sd, 1);
@@ -7374,7 +7396,7 @@ int bt_le_per_adv_sync_create(const struct bt_le_per_adv_sync_param *param,
 	 * the advertiser address in the sync params.
 	 */
 	if (!atomic_test_bit(bt_dev.flags, BT_DEV_SCANNING)) {
-		err = bt_le_scan_update(false);
+		err = bt_le_scan_update(true);
 
 		if (err) {
 			bt_le_per_adv_sync_delete(per_adv_sync);
@@ -9164,10 +9186,9 @@ int bt_le_oob_get_local(uint8_t id, struct bt_le_oob *oob)
 		bt_addr_le_copy(&oob->addr, &bt_dev.id_addr[id]);
 	}
 
-	if (IS_ENABLED(CONFIG_BT_SMP) &&
-	    !IS_ENABLED(CONFIG_BT_SMP_OOB_LEGACY_PAIR_ONLY)) {
+	if (IS_ENABLED(CONFIG_BT_SMP)) {
 		err = bt_smp_le_oob_generate_sc_data(&oob->le_sc_data);
-		if (err) {
+		if (err && err != -ENOTSUP) {
 			return err;
 		}
 	}
@@ -9220,10 +9241,9 @@ int bt_le_ext_adv_oob_get_local(struct bt_le_ext_adv *adv,
 		bt_addr_le_copy(&oob->addr, &bt_dev.id_addr[adv->id]);
 	}
 
-	if (IS_ENABLED(CONFIG_BT_SMP) &&
-	    !IS_ENABLED(CONFIG_BT_SMP_OOB_LEGACY_PAIR_ONLY)) {
+	if (IS_ENABLED(CONFIG_BT_SMP)) {
 		err = bt_smp_le_oob_generate_sc_data(&oob->le_sc_data);
-		if (err) {
+		if (err && err != -ENOTSUP) {
 			return err;
 		}
 	}

subsys/bluetooth/host/l2cap.c

@@ -778,6 +778,19 @@ static void l2cap_chan_rx_init(struct bt_l2cap_le_chan *chan)
 		chan->rx.mtu = L2CAP_MAX_LE_MTU;
 	}
 
+	/* MPS shall not be bigger than MTU + 2 as the remaining bytes cannot
+	 * be used.
+	 */
+	chan->rx.mps = MIN(chan->rx.mtu + 2, L2CAP_MAX_LE_MPS);
+
+	/* Truncate MTU if channel have disabled segmentation but still have
+	 * set an MTU which requires it.
+	 */
+	if (!chan->chan.ops->alloc_buf && (chan->rx.mps < chan->rx.mtu + 2)) {
+		BT_WARN("Segmentation disabled but MTU > MPS, truncating MTU");
+		chan->rx.mtu = chan->rx.mps - 2;
+	}
+
 	/* Use existing credits if defined */
 	if (!chan->rx.init_credits) {
 		if (chan->chan.ops->alloc_buf) {
@@ -790,10 +803,6 @@ static void l2cap_chan_rx_init(struct bt_l2cap_le_chan *chan)
 		}
 	}
 
-	/* MPS shall not be bigger than MTU + 2 as the remaining bytes cannot
-	 * be used.
-	 */
-	chan->rx.mps = MIN(chan->rx.mtu + 2, L2CAP_MAX_LE_MPS);
 	atomic_set(&chan->rx.credits,  0);
 
 	if (BT_DBG_ENABLED &&

subsys/bluetooth/host/smp.c

@@ -279,6 +279,21 @@ static bool sc_supported;
 static const uint8_t *sc_public_key;
 static K_SEM_DEFINE(sc_local_pkey_ready, 0, 1);
 
+static bool le_sc_supported(void)
+{
+	/*
+	 * If controller based ECC is to be used it must support
+	 * "LE Read Local P-256 Public Key" and "LE Generate DH Key" commands.
+	 * Otherwise LE SC are not supported.
+	 */
+	if (IS_ENABLED(CONFIG_BT_SMP_OOB_LEGACY_PAIR_ONLY)) {
+		return false;
+	}
+
+	return BT_CMD_TEST(bt_dev.supported_commands, 34, 1) &&
+	       BT_CMD_TEST(bt_dev.supported_commands, 34, 2);
+}
+
 static uint8_t get_io_capa(void)
 {
 	if (!bt_auth) {
@@ -5115,11 +5130,14 @@ int bt_smp_le_oob_set_tk(struct bt_conn *conn, const uint8_t *tk)
 }
 #endif /* !defined(CONFIG_BT_SMP_SC_PAIR_ONLY) */
 
-#if !defined(CONFIG_BT_SMP_OOB_LEGACY_PAIR_ONLY)
 int bt_smp_le_oob_generate_sc_data(struct bt_le_oob_sc_data *le_sc_oob)
 {
 	int err;
 
+	if (!le_sc_supported()) {
+		return -ENOTSUP;
+	}
+
 	if (!sc_public_key) {
 		err = k_sem_take(&sc_local_pkey_ready, K_FOREVER);
 		if (err) {
@@ -5149,7 +5167,6 @@ int bt_smp_le_oob_generate_sc_data(struct bt_le_oob_sc_data *le_sc_oob)
 
 	return 0;
 }
-#endif /* !defined(CONFIG_BT_SMP_OOB_LEGACY_PAIR_ONLY) */
 
 #if !defined(CONFIG_BT_SMP_OOB_LEGACY_PAIR_ONLY)
 static bool le_sc_oob_data_check(struct bt_smp *smp, bool oobd_local_present,
@@ -5518,21 +5535,6 @@ static int bt_smp_accept(struct bt_conn *conn, struct bt_l2cap_chan **chan)
 	return -ENOMEM;
 }
 
-static bool le_sc_supported(void)
-{
-	/*
-	 * If controller based ECC is to be used it must support
-	 * "LE Read Local P-256 Public Key" and "LE Generate DH Key" commands.
-	 * Otherwise LE SC are not supported.
-	 */
-	if (IS_ENABLED(CONFIG_BT_SMP_OOB_LEGACY_PAIR_ONLY)) {
-		return false;
-	}
-
-	return BT_CMD_TEST(bt_dev.supported_commands, 34, 1) &&
-	       BT_CMD_TEST(bt_dev.supported_commands, 34, 2);
-}
-
 BT_L2CAP_CHANNEL_DEFINE(smp_fixed_chan, BT_L2CAP_CID_SMP, bt_smp_accept, NULL);
 #if defined(CONFIG_BT_BREDR)
 BT_L2CAP_CHANNEL_DEFINE(smp_br_fixed_chan, BT_L2CAP_CID_BR_SMP,

subsys/bluetooth/mesh/prov.c

@@ -73,12 +73,14 @@
 #define PROV_ALG_P256          0x00
 
 enum {
-	WAIT_PUB_KEY,          /* Waiting for local PubKey to be generated */
-	LINK_ACTIVE,           /* Link has been opened */
-	WAIT_NUMBER,           /* Waiting for number input from user */
-	WAIT_STRING,           /* Waiting for string input from user */
-	NOTIFY_INPUT_COMPLETE, /* Notify that input has been completed. */
-	PROVISIONER,           /* The link was opened as provisioner */
+	WAIT_PUB_KEY,           /* Waiting for local PubKey to be generated */
+	LINK_ACTIVE,            /* Link has been opened */
+	WAIT_NUMBER,            /* Waiting for number input from user */
+	WAIT_STRING,            /* Waiting for string input from user */
+	NOTIFY_INPUT_COMPLETE,  /* Notify that input has been completed. */
+	PROVISIONER,            /* The link was opened as provisioner */
+	PUB_KEY_SENT,           /* Public key has been sent */
+	INPUT_COMPLETE,         /* Device input completed */
 
 	NUM_FLAGS,
 };
@@ -586,6 +588,15 @@ static void send_input_complete(void)
 	link.expect = PROV_CONFIRM;
 }
 
+static void input_complete(void)
+{
+	if (atomic_test_bit(link.flags, PUB_KEY_SENT)) {
+		send_input_complete();
+	} else {
+		atomic_set_bit(link.flags, INPUT_COMPLETE);
+	}
+}
+
 int bt_mesh_input_number(uint32_t num)
 {
 	BT_DBG("%u", num);
@@ -596,7 +607,7 @@ int bt_mesh_input_number(uint32_t num)
 
 	sys_put_be32(num, &link.auth[12]);
 
-	send_input_complete();
+	input_complete();
 
 	return 0;
 }
@@ -611,11 +622,21 @@ int bt_mesh_input_string(const char *str)
 
 	strncpy((char *)link.auth, str, prov->input_size);
 
-	send_input_complete();
+	input_complete();
 
 	return 0;
 }
 
+static void public_key_sent(int err, void *cb_data)
+{
+	atomic_set_bit(link.flags, PUB_KEY_SENT);
+
+	if (atomic_test_bit(link.flags, INPUT_COMPLETE)) {
+		send_input_complete();
+		return;
+	}
+}
+
 static void send_pub_key(void)
 {
 	PROV_BUF(buf, 65);
@@ -644,7 +665,7 @@ static void send_pub_key(void)
 		memcpy(&link.conf_inputs[81], &buf.data[1], 64);
 	}
 
-	if (prov_send(&buf, NULL)) {
+	if (prov_send(&buf, public_key_sent)) {
 		BT_ERR("Failed to send Public Key");
 		return;
 	}
@@ -884,6 +905,12 @@ static void prov_random(const uint8_t *data)
 
 	BT_DBG("Remote Random: %s", bt_hex(data, 16));
 
+	if (!memcmp(data, link.rand, 16)) {
+		BT_ERR("Random value is identical to ours, rejecting.");
+		prov_fail(PROV_ERR_CFM_FAILED);
+		return;
+	}
+
 	if (bt_mesh_prov_conf(link.conf_key, data, link.auth, conf_verify)) {
 		BT_ERR("Unable to calculate confirmation verification");
 		prov_fail(PROV_ERR_UNEXP_ERR);

subsys/bluetooth/shell/bt.c

@@ -1399,6 +1399,13 @@ static void per_adv_sync_terminated_cb(
 {
 	char le_addr[BT_ADDR_LE_STR_LEN];
 
+	for (int i = 0; i < ARRAY_SIZE(per_adv_syncs); i++) {
+		if (per_adv_syncs[i] == sync) {
+			per_adv_syncs[i] = NULL;
+			break;
+		}
+	}
+
 	bt_addr_le_to_str(info->addr, le_addr, sizeof(le_addr));
 	shell_print(ctx_shell, "PER_ADV_SYNC[%u]: [DEVICE]: %s sync terminated",
 		    bt_le_per_adv_sync_get_index(sync), le_addr);
@@ -2779,9 +2786,9 @@ SHELL_STATIC_SUBCMD_SET_CREATE(bt_cmds,
 	SHELL_CMD_ARG(per-adv-sync-create, NULL,
 		      HELP_ADDR_LE " <sid> [skip <count>] [timeout <ms>] [aoa] "
 		      "[aod_1us] [aod_2us] [cte_only]",
-		      cmd_per_adv_sync_create, 2, 7),
+		      cmd_per_adv_sync_create, 4, 6),
 	SHELL_CMD_ARG(per-adv-sync-delete, NULL, "[<index>]",
-		      cmd_per_adv_sync_delete, 1, 0),
+		      cmd_per_adv_sync_delete, 1, 1),
 #endif /* defined(CONFIG_BT_PER_ADV_SYNC) */
 #endif
 #endif /* CONFIG_BT_BROADCASTER */

subsys/logging/log_msg.c

@@ -444,7 +444,7 @@ static void log_msg_hexdump_data_op(struct log_msg *msg,
 		}
 	}
 
-	while (req_len > 0) {
+	while ((req_len > 0) && (cont != NULL)) {
 		chunk_len = HEXDUMP_BYTES_CONT_MSG - offset;
 		cpy_len = req_len > chunk_len ? chunk_len : req_len;
 

subsys/net/ip/Kconfig.ipv4

@@ -48,6 +48,7 @@ config NET_IPV4_ACCEPT_ZERO_BROADCAST
 
 config NET_DHCPV4
 	bool "Enable DHCPv4 client"
+	depends on NET_UDP
 
 config NET_DHCPV4_INITIAL_DELAY_MAX
 	int "Maximum time out for initial discover request"

subsys/net/ip/connection.c

@@ -513,6 +513,7 @@ enum net_verdict net_conn_input(struct net_pkt *pkt,
 	struct net_if *pkt_iface = net_pkt_iface(pkt);
 	struct net_conn *best_match = NULL;
 	bool is_mcast_pkt = false, mcast_pkt_delivered = false;
+	bool is_bcast_pkt = false;
 	bool raw_pkt_delivered = false;
 	int16_t best_rank = -1;
 	struct net_conn *conn;
@@ -564,6 +565,9 @@ enum net_verdict net_conn_input(struct net_pkt *pkt,
 	if (IS_ENABLED(CONFIG_NET_IPV4) && net_pkt_family(pkt) == AF_INET) {
 		if (net_ipv4_is_addr_mcast(&ip_hdr->ipv4->dst)) {
 			is_mcast_pkt = true;
+		} else if (net_if_ipv4_is_addr_bcast(pkt_iface,
+						     &ip_hdr->ipv4->dst)) {
+			is_bcast_pkt = true;
 		}
 	} else if (IS_ENABLED(CONFIG_NET_IPV6) &&
 					   net_pkt_family(pkt) == AF_INET6) {
@@ -746,7 +750,8 @@ enum net_verdict net_conn_input(struct net_pkt *pkt,
 	    net_pkt_family(pkt) == AF_INET6 && is_mcast_pkt) {
 		;
 	} else if (IS_ENABLED(CONFIG_NET_IPV4) &&
-		   net_pkt_family(pkt) == AF_INET && is_mcast_pkt) {
+		   net_pkt_family(pkt) == AF_INET &&
+		   (is_mcast_pkt || is_bcast_pkt)) {
 		;
 	} else if (IS_ENABLED(CONFIG_NET_SOCKETS_PACKET) &&
 		    net_pkt_family(pkt) == AF_PACKET) {

subsys/net/ip/net_core.c

@@ -382,7 +382,7 @@ int net_recv_data(struct net_if *iface, struct net_pkt *pkt)
 		return -EINVAL;
 	}
 
-	if (!pkt->frags) {
+	if (net_pkt_is_empty(pkt)) {
 		return -ENODATA;
 	}
 

subsys/net/ip/net_shell.c

@@ -2140,11 +2140,14 @@ static void gptp_print_port_info(const struct shell *shell, int port)
 	struct gptp_port_bmca_data *port_bmca_data;
 	struct gptp_port_param_ds *port_param_ds;
 	struct gptp_port_states *port_state;
+	struct gptp_domain *gptp_domain;
 	struct gptp_port_ds *port_ds;
 	struct net_if *iface;
 	int ret, i;
 
-	ret = gptp_get_port_data(gptp_get_domain(),
+	gptp_domain = gptp_get_domain();
+
+	ret = gptp_get_port_data(gptp_domain,
 				 port,
 				 &port_ds,
 				 &port_param_ds,
@@ -2241,6 +2244,12 @@ static void gptp_print_port_info(const struct shell *shell, int port)
 	   "transmission interval for the port",
 	   USCALED_NS_TO_NS(port_ds->pdelay_req_itv.low) /
 					(NSEC_PER_USEC * USEC_PER_MSEC));
+	PR("BMCA %s %s%d%s: %d\n", "default", "priority", 1,
+	   "                                        ",
+	   gptp_domain->default_ds.priority1);
+	PR("BMCA %s %s%d%s: %d\n", "default", "priority", 2,
+	   "                                        ",
+	   gptp_domain->default_ds.priority2);
 
 	PR("\nRuntime status:\n");
 	PR("Current global port state                          "

subsys/net/ip/tcp2.c

@@ -282,9 +282,7 @@ static void tcp_send_queue_flush(struct tcp *conn)
 {
 	struct net_pkt *pkt;
 
-	if (k_delayed_work_remaining_get(&conn->send_timer)) {
-		k_delayed_work_cancel(&conn->send_timer);
-	}
+	k_delayed_work_cancel(&conn->send_timer);
 
 	while ((pkt = tcp_slist(&conn->send_queue, get,
 				struct net_pkt, next))) {
@@ -332,9 +330,7 @@ static int tcp_conn_unref(struct tcp *conn)
 
 	tcp_send_queue_flush(conn);
 
-	if (k_delayed_work_remaining_get(&conn->send_data_timer)) {
-		k_delayed_work_cancel(&conn->send_data_timer);
-	}
+	k_delayed_work_cancel(&conn->send_data_timer);
 	tcp_pkt_unref(conn->send_data);
 
 	k_delayed_work_cancel(&conn->timewait_timer);
@@ -702,7 +698,7 @@ static int tcp_out_ext(struct tcp *conn, uint8_t flags, struct net_pkt *data,
 
 	sys_slist_append(&conn->send_queue, &pkt->next);
 
-	tcp_send_process((struct k_work *)&conn->send_timer);
+	tcp_send_process(&conn->send_timer.work);
 out:
 	return ret;
 }
@@ -1450,7 +1446,7 @@ int net_tcp_put(struct net_context *context)
 	if (conn && conn->state == TCP_ESTABLISHED) {
 		/* Send all remaining data if possible. */
 		if (conn->send_data_total > 0) {
-			NET_DBG("conn %p pending %u bytes", conn,
+			NET_DBG("conn %p pending %zu bytes", conn,
 				conn->send_data_total);
 			conn->in_close = true;
 
@@ -1521,8 +1517,7 @@ int net_tcp_queue_data(struct net_context *context, struct net_pkt *pkt)
 		/* Trigger resend if the timer is not active */
 		if (!k_delayed_work_remaining_get(&conn->send_data_timer)) {
 			NET_DBG("Window full, trigger resend");
-			tcp_resend_data(
-				   (struct k_work *)&conn->send_data_timer);
+			tcp_resend_data(&conn->send_data_timer.work);
 		}
 
 		ret = -EAGAIN;

subsys/net/l2/ethernet/gptp/Kconfig

@@ -195,6 +195,31 @@ config NET_GPTP_PATH_TRACE_ELEMENTS
 	  Announce message. Each array element takes 8 bytes. If this value
 	  is set to 8, then 8 * 8 = 64 bytes of memory is used.
 
+config NET_GPTP_BMCA_PRIORITY1
+	int "BMCA priority1 value"
+	default 248 if NET_GPTP_GM_CAPABLE
+	default 255
+	range 0 255
+	help
+	  The priority1 attribute of the local clock. It is used in the
+	  Best Master Clock selection Algorithm (BMCA), lower values take
+	  precedence. The default value is 255 if the device is non grand
+	  master capable, and 248 if it is GM capable.
+	  See Chapter 8.6.2.1 of IEEE 802.1AS for a more detailed description
+	  of priority1. Note that if the system	is non GM capable, then the
+	  value 255 is used always and this setting is ignored.
+
+config NET_GPTP_BMCA_PRIORITY2
+	int "BMCA priority2 value"
+	default 248
+	range 0 255
+	help
+	  The priority2 attribute of the local clock. It is used in the BMCA
+	  (Best Master Clock selection Algorithm), lower values take
+	  precedence. The default value is 248.
+	  See Chapter 8.6.2.5 of IEEE 802.1AS for a more detailed description
+	  of priority2.
+
 config NET_GPTP_STATISTICS
 	bool "Collect gPTP statistics"
 	help

subsys/net/l2/ethernet/gptp/gptp.c

@@ -382,7 +382,15 @@ static void gptp_init_clock_ds(void)
 		GPTP_OFFSET_SCALED_LOG_VAR_UNKNOWN;
 
 	if (default_ds->gm_capable) {
-		default_ds->priority1 = GPTP_PRIORITY1_GM_CAPABLE;
+		/* The priority1 value cannot be 255 for GM capable
+		 * system.
+		 */
+		if (CONFIG_NET_GPTP_BMCA_PRIORITY1 ==
+		    GPTP_PRIORITY1_NON_GM_CAPABLE) {
+			default_ds->priority1 = GPTP_PRIORITY1_GM_CAPABLE;
+		} else {
+			default_ds->priority1 = CONFIG_NET_GPTP_BMCA_PRIORITY1;
+		}
 	} else {
 		default_ds->priority1 = GPTP_PRIORITY1_NON_GM_CAPABLE;
 	}

subsys/net/l2/openthread/Kconfig

@@ -130,7 +130,7 @@ config OPENTHREAD_THREAD_PRIORITY
 
 config OPENTHREAD_THREAD_STACK_SIZE
 	int "OpenThread thread stack size"
-	default 6144 if OPENTHREAD_COMMISSIONER
+	default 6144 if OPENTHREAD_COMMISSIONER || OPENTHREAD_JOINER
 	default 3072
 
 config OPENTHREAD_PKT_LIST_SIZE

subsys/net/l2/openthread/Kconfig.thread

@@ -27,7 +27,6 @@ config OPENTHREAD_XPANID
 config OPENTHREAD_JOINER_AUTOSTART
 	bool "Enable automatic joiner start"
 	depends on OPENTHREAD_JOINER
-	depends on !OPENTHREAD_MANUAL_START
 
 config OPENTHREAD_JOINER_PSKD
 	string "Default pre shared key for the Joiner"

subsys/storage/flash_map/flash_map_default.c

@@ -14,25 +14,25 @@
 #define GPARENT(node_id) DT_PARENT(DT_PARENT(node_id))
 
 /* return great-grandparent label if 'soc-nv-flash' else grandparent label */
-#define DT_FLASH_DEV_FROM_PART(part)					      \
+#define DT_FLASH_DEV_FROM_PARTITION(part)				      \
 	DT_LABEL(COND_CODE_1(DT_NODE_HAS_COMPAT(GPARENT(part), soc_nv_flash), \
 			     (DT_PARENT(GPARENT(part))),		      \
 			     (GPARENT(part))))
 
-#define FLASH_AREA_FOO(part)				\
-	{.fa_id = DT_FIXED_PARTITION_ID(part),		\
-	 .fa_off = DT_REG_ADDR(part),			\
-	 .fa_dev_name = DT_FLASH_DEV_FROM_PART(part),	\
+#define FLASH_AREA_FOO(part)					\
+	{.fa_id = DT_FIXED_PARTITION_ID(part),			\
+	 .fa_off = DT_REG_ADDR(part),				\
+	 .fa_dev_name = DT_FLASH_DEV_FROM_PARTITION(part),	\
 	 .fa_size = DT_REG_SIZE(part),},
 
-#define FOREACH_PARTION(n) DT_FOREACH_CHILD(DT_DRV_INST(n), FLASH_AREA_FOO)
+#define FOREACH_PARTITION(n) DT_FOREACH_CHILD(DT_DRV_INST(n), FLASH_AREA_FOO)
 
 /* We iterate over all compatible 'fixed-partions' nodes and
  * use DT_FOREACH_CHILD to iterate over all the partitions for that
  * 'fixed-partions' node.  This way we build a global partition map
  */
 const struct flash_area default_flash_map[] = {
-	DT_INST_FOREACH_STATUS_OKAY(FOREACH_PARTION)
+	DT_INST_FOREACH_STATUS_OKAY(FOREACH_PARTITION)
 };
 
 const int flash_map_entries = ARRAY_SIZE(default_flash_map);

subsys/tracing/ctf/ctf_top.c

@@ -24,7 +24,7 @@ static void _get_thread_name(struct k_thread *thread,
 
 void sys_trace_thread_switched_out(void)
 {
-	ctf_bounded_string_t name = { "" };
+	ctf_bounded_string_t name = { "unknown" };
 	struct k_thread *thread;
 
 	thread = k_current_get();
@@ -36,7 +36,7 @@ void sys_trace_thread_switched_out(void)
 void sys_trace_thread_switched_in(void)
 {
 	struct k_thread *thread;
-	ctf_bounded_string_t name = { "" };
+	ctf_bounded_string_t name = { "unknown" };
 
 	thread = k_current_get();
 	_get_thread_name(thread, &name);
@@ -46,7 +46,7 @@ void sys_trace_thread_switched_in(void)
 
 void sys_trace_thread_priority_set(struct k_thread *thread)
 {
-	ctf_bounded_string_t name = { "" };
+	ctf_bounded_string_t name = { "unknown" };
 
 	_get_thread_name(thread, &name);
 	ctf_top_thread_priority_set((uint32_t)(uintptr_t)thread,
@@ -55,7 +55,7 @@ void sys_trace_thread_priority_set(struct k_thread *thread)
 
 void sys_trace_thread_create(struct k_thread *thread)
 {
-	ctf_bounded_string_t name = { "" };
+	ctf_bounded_string_t name = { "unknown" };
 
 	_get_thread_name(thread, &name);
 	ctf_top_thread_create(
@@ -76,7 +76,7 @@ void sys_trace_thread_create(struct k_thread *thread)
 
 void sys_trace_thread_abort(struct k_thread *thread)
 {
-	ctf_bounded_string_t name = { "" };
+	ctf_bounded_string_t name = { "unknown" };
 
 	_get_thread_name(thread, &name);
 	ctf_top_thread_abort((uint32_t)(uintptr_t)thread, name);
@@ -84,7 +84,7 @@ void sys_trace_thread_abort(struct k_thread *thread)
 
 void sys_trace_thread_suspend(struct k_thread *thread)
 {
-	ctf_bounded_string_t name = { "" };
+	ctf_bounded_string_t name = { "unknown" };
 
 	_get_thread_name(thread, &name);
 	ctf_top_thread_suspend((uint32_t)(uintptr_t)thread, name);
@@ -92,7 +92,7 @@ void sys_trace_thread_suspend(struct k_thread *thread)
 
 void sys_trace_thread_resume(struct k_thread *thread)
 {
-	ctf_bounded_string_t name = { "" };
+	ctf_bounded_string_t name = { "unknown" };
 
 	_get_thread_name(thread, &name);
 
@@ -101,7 +101,7 @@ void sys_trace_thread_resume(struct k_thread *thread)
 
 void sys_trace_thread_ready(struct k_thread *thread)
 {
-	ctf_bounded_string_t name = { "" };
+	ctf_bounded_string_t name = { "unknown" };
 
 	_get_thread_name(thread, &name);
 
@@ -110,7 +110,7 @@ void sys_trace_thread_ready(struct k_thread *thread)
 
 void sys_trace_thread_pend(struct k_thread *thread)
 {
-	ctf_bounded_string_t name = { "" };
+	ctf_bounded_string_t name = { "unknown" };
 
 	_get_thread_name(thread, &name);
 	ctf_top_thread_pend((uint32_t)(uintptr_t)thread, name);
@@ -119,7 +119,7 @@ void sys_trace_thread_pend(struct k_thread *thread)
 void sys_trace_thread_info(struct k_thread *thread)
 {
 #if defined(CONFIG_THREAD_STACK_INFO)
-	ctf_bounded_string_t name = { "" };
+	ctf_bounded_string_t name = { "unknown" };
 
 	_get_thread_name(thread, &name);
 	ctf_top_thread_info(
@@ -133,7 +133,7 @@ void sys_trace_thread_info(struct k_thread *thread)
 
 void sys_trace_thread_name_set(struct k_thread *thread)
 {
-	ctf_bounded_string_t name = { "" };
+	ctf_bounded_string_t name = { "unknown" };
 
 	_get_thread_name(thread, &name);
 	ctf_top_thread_name_set(

subsys/tracing/sysview/sysview.c

@@ -12,6 +12,12 @@
 #include <Global.h>
 #include "SEGGER_SYSVIEW_Zephyr.h"
 
+#if CONFIG_THREAD_MAX_NAME_LEN
+#define THREAD_NAME_LEN CONFIG_THREAD_MAX_NAME_LEN
+#else
+#define THREAD_NAME_LEN 20
+#endif
+
 static uint32_t interrupt;
 
 uint32_t sysview_get_timestamp(void)
@@ -100,22 +106,29 @@ void sys_trace_mutex_unlock(struct k_mutex *mutex)
 }
 
 
+
 static void send_task_list_cb(void)
 {
 	struct k_thread *thread;
 
 	for (thread = _kernel.threads; thread; thread = thread->next_thread) {
-		char name[20];
+		char name[THREAD_NAME_LEN];
 		const char *tname = k_thread_name_get(thread);
 
 		if (z_is_idle_thread_object(thread)) {
 			continue;
 		}
 
-		snprintk(name, sizeof(name), "T%pE%p", thread, &thread->entry);
+		if (tname != NULL && tname[0] != '\0') {
+			memcpy(name, tname, THREAD_NAME_LEN);
+			name[THREAD_NAME_LEN - 1] = '\0';
+		} else {
+			snprintk(name, sizeof(name), "T%pE%p",
+				 thread, &thread->entry);
+		}
 		SEGGER_SYSVIEW_SendTaskInfo(&(SEGGER_SYSVIEW_TASKINFO) {
 			.TaskID = (uint32_t)(uintptr_t)thread,
-		      .sName = tname?tname:name,
+			.sName = name,
 			.StackSize = thread->stack_info.size,
 			.StackBase = thread->stack_info.start,
 			.Prio = thread->base.prio,

tests/arch/x86/cpu_scrubs_regs/CMakeLists.txt

@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: Apache-2.0
+
+cmake_minimum_required(VERSION 3.13.1)
+find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE})
+project(cpu_scrubs_regs)
+
+enable_language(ASM)
+
+FILE(GLOB app_sources src/*.c)
+target_sources(app PRIVATE ${app_sources})

tests/arch/x86/cpu_scrubs_regs/prj.conf

@@ -0,0 +1,3 @@
+CONFIG_ZTEST=y
+CONFIG_TEST_USERSPACE=y
+CONFIG_APPLICATION_DEFINED_SYSCALL=y

tests/arch/x86/cpu_scrubs_regs/src/main.c

@@ -0,0 +1,130 @@
+/*
+ * Copyright (c) 2020 Intel Corporation
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <zephyr.h>
+#include <syscall_handler.h>
+#include <ztest.h>
+#include "test_syscalls.h"
+
+#define DB_VAL 0xDEADBEEF
+
+void z_impl_test_cpu_write_reg(void)
+{
+	/* User thread CPU write registers system call for testing
+	*
+	* Verify the following
+	* - Write 0xDEADBEEF values during system call into registers
+	* - In main test we will read that registers to verify
+	* that all of them were scrubbed and do not contain any sensitive data
+	*/
+
+	/* Part below is made to test that kernel scrubs CPU registers
+	 * after returning from the system call
+	 */
+#if CONFIG_X86
+#ifndef CONFIG_X86_64
+	__asm__ volatile (
+		"movl $0xDEADBEEF, %eax;\n\t"
+		"movl $0xDEADBEEF, %ebx;\n\t"
+		"movl $0xDEADBEEF, %ecx;\n\t"
+		"movl $0xDEADBEEF, %edx;\n\t"
+		"movl $0xDEADBEEF, %edi;\n\t"
+		);
+#else
+	__asm__ volatile (
+		"movq $0xDEADBEEF, %rax;\n\t"
+		"movq $0xDEADBEEF, %rcx;\n\t"
+		"movq $0xDEADBEEF, %rdx;\n\t"
+		"movq $0xDEADBEEF, %rsi;\n\t"
+		"movq $0xDEADBEEF, %rdi;\n\t"
+		"movq $0xDEADBEEF, %r8;\n\t"
+		"movq $0xDEADBEEF, %r9;\n\t"
+		"movq $0xDEADBEEF, %r10;\n\t"
+		"movq $0xDEADBEEF, %r11;\n\t"
+		);
+#endif
+#endif
+}
+
+static inline void z_vrfy_test_cpu_write_reg(void)
+{
+	z_impl_test_cpu_write_reg();
+}
+#include <syscalls/test_cpu_write_reg_mrsh.c>
+
+/**
+ * @brief Test CPU scrubs registers after system call
+ *
+ * @details - Call from user mode a syscall test_x86_cpu_write_reg(),
+ * the system call function writes into registers 0xDEADBEEF value
+ * - Then in main test function below check registers values,
+ * if no 0xDEADBEEF value detected, that means CPU scrubbed registers
+ * before exit from the system call.
+ *
+ * @ingroup kernel_memprotect_tests
+ */
+void test_syscall_cpu_scrubs_regs(void)
+{
+#if CONFIG_X86
+#ifndef CONFIG_X86_64
+	int x86_reg_val[5];
+
+	test_cpu_write_reg();
+	__asm__ volatile (
+		"\t movl %%eax,%0" : "=r"(x86_reg_val[0]));
+	__asm__ volatile (
+		"\t movl %%ebx,%0" : "=r"(x86_reg_val[1]));
+	__asm__ volatile (
+		"\t movl %%ecx,%0" : "=r"(x86_reg_val[2]));
+	__asm__ volatile (
+		"\t movl %%edx,%0" : "=r"(x86_reg_val[3]));
+	__asm__ volatile (
+		"\t movl %%edi,%0" : "=r"(x86_reg_val[4]));
+
+	for (int i = 0; i < 5; i++) {
+		zassert_not_equal(x86_reg_val[i], DB_VAL,
+				"reg val is 0xDEADBEEF, "
+				"not scrubbed after system call.");
+	}
+#else
+	long x86_64_reg_val[9];
+
+	test_cpu_write_reg();
+
+	__asm__ volatile(
+		"\t movq %%rax,%0" : "=r"(x86_64_reg_val[0]));
+	__asm__ volatile(
+		"\t movq %%rcx,%0" : "=r"(x86_64_reg_val[1]));
+	__asm__ volatile(
+		"\t movq %%rdx,%0" : "=r"(x86_64_reg_val[2]));
+	__asm__ volatile(
+		"\t movq %%rsi,%0" : "=r"(x86_64_reg_val[3]));
+	__asm__ volatile(
+		"\t movq %%rdi,%0" : "=r"(x86_64_reg_val[4]));
+	__asm__ volatile(
+		"\t movq %%r8,%0" : "=r"(x86_64_reg_val[5]));
+	__asm__ volatile(
+		"\t movq %%r9,%0" : "=r"(x86_64_reg_val[6]));
+	__asm__ volatile(
+		"\t movq %%r10,%0" : "=r"(x86_64_reg_val[7]));
+	__asm__ volatile(
+		"\t movq %%r11,%0" : "=r"(x86_64_reg_val[8]));
+
+	for (int i = 0; i < 9; i++) {
+		zassert_not_equal(x86_64_reg_val[i], DB_VAL,
+				"register value is 0xDEADBEEF, "
+				"not scrubbed after system call.");
+	}
+#endif
+#endif
+}
+
+void test_main(void)
+{
+	ztest_test_suite(test_x86_cpu_scrubs_regs,
+		ztest_user_unit_test(test_syscall_cpu_scrubs_regs));
+	ztest_run_test_suite(test_x86_cpu_scrubs_regs);
+}

tests/arch/x86/cpu_scrubs_regs/src/test_syscalls.h

@@ -0,0 +1,15 @@
+/*
+ * Copyright (c) 2020 Intel Corporation
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef _TEST_SYSCALLS_H_
+#define _TEST_SYSCALLS_H_
+#include <zephyr.h>
+
+__syscall void test_cpu_write_reg(void);
+
+#include <syscalls/test_syscalls.h>
+
+#endif /* _TEST_SYSCALLS_H_ */