github: workflows: disable workflows

Disable workflows because the branch is no longer maintained.

Signed-off-by: Thomas Stranger <thomas.stranger@outlook.com>

.github/workflows/backport_issue_check.yml.disabled

@@ -2,12 +2,20 @@ name: Backport Issue Check
 
 on:
   pull_request_target:
+    types:
+      - edited
+      - opened
+      - reopened
+      - synchronize
     branches:
       - v*-branch
 
 jobs:
   backport:
     name: Backport Issue Check
+    concurrency:
+      group: backport-issue-check-${{ github.ref }}
+      cancel-in-progress: true
     runs-on: ubuntu-22.04
     if: github.repository == 'zephyrproject-rtos/zephyr'
 

.github/workflows/bsim-tests.yaml.disabled

@@ -30,12 +30,11 @@ concurrency:
 jobs:
   bsim-test:
     if: github.repository_owner == 'zephyrproject-rtos'
-    runs-on: zephyr-runner-linux-x64-4xlarge
+    runs-on:
+      group: zephyr-runner-v2-linux-x64-4xlarge
     container:
-      image: ghcr.io/zephyrproject-rtos/ci:v0.26.7
+      image: ghcr.io/zephyrproject-rtos/ci-repo-cache:v0.26.7.20240313
       options: '--entrypoint /bin/bash'
-      volumes:
-        - /repo-cache/zephyrproject:/github/cache/zephyrproject
     env:
       ZEPHYR_TOOLCHAIN_VARIANT: zephyr
       BSIM_OUT_PATH: /opt/bsim/
@@ -55,10 +54,16 @@ jobs:
           #        GitHub comes up with a fundamental fix for this problem.
           git config --global --add safe.directory ${GITHUB_WORKSPACE}
 
+      - name: Print cloud service information
+        run: |
+          echo "ZEPHYR_RUNNER_CLOUD_PROVIDER = ${ZEPHYR_RUNNER_CLOUD_PROVIDER}"
+          echo "ZEPHYR_RUNNER_CLOUD_NODE = ${ZEPHYR_RUNNER_CLOUD_NODE}"
+          echo "ZEPHYR_RUNNER_CLOUD_POD = ${ZEPHYR_RUNNER_CLOUD_POD}"
+
       - name: Clone cached Zephyr repository
         continue-on-error: true
         run: |
-          git clone --shared /github/cache/zephyrproject/zephyr .
+          git clone --shared /repo-cache/zephyrproject/zephyr .
           git remote set-url origin ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}
 
       - name: Checkout
@@ -78,7 +83,7 @@ jobs:
           west init -l . || true
           west config manifest.group-filter -- +ci
           west config --global update.narrow true
-          west update --path-cache /github/cache/zephyrproject 2>&1 1> west.update.log || west update --path-cache /github/cache/zephyrproject 2>&1 1> west.update.log || ( rm -rf ../modules ../bootloader ../tools && west update --path-cache /github/cache/zephyrproject)
+          west update --path-cache /repo-cache/zephyrproject 2>&1 1> west.update.log || west update --path-cache /repo-cache/zephyrproject 2>&1 1> west.update.log || ( rm -rf ../modules ../bootloader ../tools && west update --path-cache /repo-cache/zephyrproject)
           west forall -c 'git reset --hard HEAD'
 
           echo "ZEPHYR_SDK_INSTALL_DIR=/opt/toolchains/zephyr-sdk-$( cat SDK_VERSION )" >> $GITHUB_ENV

.github/workflows/clang.yaml.disabled

@@ -9,17 +9,19 @@ concurrency:
 jobs:
   clang-build:
     if: github.repository_owner == 'zephyrproject-rtos'
-    runs-on: zephyr-runner-linux-x64-4xlarge
+    runs-on:
+      group: zephyr-runner-v2-linux-x64-4xlarge
     container:
-      image: ghcr.io/zephyrproject-rtos/ci:v0.26.7
+      image: ghcr.io/zephyrproject-rtos/ci-repo-cache:v0.26.7.20240313
       options: '--entrypoint /bin/bash'
-      volumes:
-        - /repo-cache/zephyrproject:/github/cache/zephyrproject
     strategy:
       fail-fast: false
       matrix:
         platform: ["native_sim"]
     env:
+      CCACHE_DIR: /node-cache/ccache-zephyr
+      CCACHE_REMOTE_STORAGE: "redis://cache-*.keydb-cache.svc.cluster.local|shards=1,2,3"
+      CCACHE_REMOTE_ONLY: "true"
       LLVM_TOOLCHAIN_PATH: /usr/lib/llvm-16
       COMMIT_RANGE: ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}
       BASE_REF: ${{ github.base_ref }}
@@ -34,10 +36,16 @@ jobs:
           #        GitHub comes up with a fundamental fix for this problem.
           git config --global --add safe.directory ${GITHUB_WORKSPACE}
 
+      - name: Print cloud service information
+        run: |
+          echo "ZEPHYR_RUNNER_CLOUD_PROVIDER = ${ZEPHYR_RUNNER_CLOUD_PROVIDER}"
+          echo "ZEPHYR_RUNNER_CLOUD_NODE = ${ZEPHYR_RUNNER_CLOUD_NODE}"
+          echo "ZEPHYR_RUNNER_CLOUD_POD = ${ZEPHYR_RUNNER_CLOUD_POD}"
+
       - name: Clone cached Zephyr repository
         continue-on-error: true
         run: |
-          git clone --shared /github/cache/zephyrproject/zephyr .
+          git clone --shared /repo-cache/zephyrproject/zephyr .
           git remote set-url origin ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}
 
       - name: Checkout
@@ -63,7 +71,7 @@ jobs:
           # So first retry to update, if that does not work, remove all modules
           # and start over. (Workaround until we implement more robust module
           # west caching).
-          west update --path-cache /github/cache/zephyrproject 2>&1 1> west.log || west update --path-cache /github/cache/zephyrproject 2>&1 1> west2.log || ( rm -rf ../modules ../bootloader ../tools && west update --path-cache /github/cache/zephyrproject)
+          west update --path-cache /repo-cache/zephyrproject 2>&1 1> west.log || west update --path-cache /repo-cache/zephyrproject 2>&1 1> west2.log || ( rm -rf ../modules ../bootloader ../tools && west update --path-cache /repo-cache/zephyrproject)
 
           echo "ZEPHYR_SDK_INSTALL_DIR=/opt/toolchains/zephyr-sdk-$( cat SDK_VERSION )" >> $GITHUB_ENV
 
@@ -74,31 +82,12 @@ jobs:
           gcc --version
           ls -la
 
-      - name: Prepare ccache timestamp/data
-        id: ccache_cache_timestamp
-        shell: cmake -P {0}
+      - name: Set up ccache
         run: |
-          string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
-          string(REPLACE "/" "_" repo ${{github.repository}})
-          string(REPLACE "-" "_" repo2 ${repo})
-          file(APPEND $ENV{GITHUB_OUTPUT} "repo=${repo2}\n")
-
-      - name: use cache
-        id: cache-ccache
-        uses: zephyrproject-rtos/action-s3-cache@v1.2.0
-        with:
-          key: ${{ steps.ccache_cache_timestamp.outputs.repo }}-${{ github.ref_name }}-clang-${{ matrix.platform }}-ccache
-          path: /github/home/.cache/ccache
-          aws-s3-bucket: ccache.zephyrproject.org
-          aws-access-key-id: ${{ vars.AWS_CCACHE_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_CCACHE_SECRET_ACCESS_KEY }}
-          aws-region: us-east-2
-
-      - name: ccache stats initial
-        run: |
-          mkdir -p /github/home/.cache
-          test -d github/home/.cache/ccache && rm -rf /github/home/.cache/ccache && mv github/home/.cache/ccache /github/home/.cache/ccache
-          ccache -M 10G -s
+          mkdir -p ${CCACHE_DIR}
+          ccache -M 10G
+          ccache -p
+          ccache -z -s -vv
 
       - name: Run Tests with Twister
         id: twister
@@ -119,10 +108,10 @@ jobs:
             echo "report_needed=0" >> $GITHUB_OUTPUT
           fi
 
-      - name: ccache stats post
+      - name: Print ccache stats
+        if: always()
         run: |
-          ccache -s
-          ccache -p
+          ccache -s -vv
 
       - name: Upload Unit Test Results
         if: always() && steps.twister.outputs.report_needed != 0

.github/workflows/codecov.yaml.disabled

@@ -10,17 +10,22 @@ concurrency:
 
 jobs:
   codecov:
-    if: github.repository == 'zephyrproject-rtos/zephyr'
-    runs-on: zephyr-runner-linux-x64-4xlarge
+    if: github.repository_owner == 'zephyrproject-rtos'
+    runs-on:
+      group: zephyr-runner-v2-linux-x64-4xlarge
     container:
-      image: ghcr.io/zephyrproject-rtos/ci:v0.26.7
+      image: ghcr.io/zephyrproject-rtos/ci-repo-cache:v0.26.7.20240313
       options: '--entrypoint /bin/bash'
-      volumes:
-        - /repo-cache/zephyrproject:/github/cache/zephyrproject
     strategy:
       fail-fast: false
       matrix:
         platform: ["mps2_an385", "native_sim", "qemu_x86", "unit_testing"]
+    env:
+      CCACHE_DIR: /node-cache/ccache-zephyr
+      CCACHE_REMOTE_STORAGE: "redis://cache-*.keydb-cache.svc.cluster.local|shards=1,2,3"
+      CCACHE_REMOTE_ONLY: "true"
+      # `--specs` is ignored because ccache is unable to resovle the toolchain specs file path.
+      CCACHE_IGNOREOPTIONS: '--specs=*'
     steps:
       - name: Apply container owner mismatch workaround
         run: |
@@ -30,6 +35,12 @@ jobs:
           #        GitHub comes up with a fundamental fix for this problem.
           git config --global --add safe.directory ${GITHUB_WORKSPACE}
 
+      - name: Print cloud service information
+        run: |
+          echo "ZEPHYR_RUNNER_CLOUD_PROVIDER = ${ZEPHYR_RUNNER_CLOUD_PROVIDER}"
+          echo "ZEPHYR_RUNNER_CLOUD_NODE = ${ZEPHYR_RUNNER_CLOUD_NODE}"
+          echo "ZEPHYR_RUNNER_CLOUD_POD = ${ZEPHYR_RUNNER_CLOUD_POD}"
+
       - name: Update PATH for west
         run: |
           echo "$HOME/.local/bin" >> $GITHUB_PATH
@@ -37,7 +48,7 @@ jobs:
       - name: Clone cached Zephyr repository
         continue-on-error: true
         run: |
-          git clone --shared /github/cache/zephyrproject/zephyr .
+          git clone --shared /repo-cache/zephyrproject/zephyr .
           git remote set-url origin ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}
 
       - name: checkout
@@ -58,30 +69,12 @@ jobs:
 
           echo "ZEPHYR_SDK_INSTALL_DIR=/opt/toolchains/zephyr-sdk-$( cat SDK_VERSION )" >> $GITHUB_ENV
 
-      - name: Prepare ccache keys
-        id: ccache_cache_prop
-        shell: cmake -P {0}
+      - name: Set up ccache
         run: |
-          string(REPLACE "/" "_" repo ${{github.repository}})
-          string(REPLACE "-" "_" repo2 ${repo})
-          file(APPEND $ENV{GITHUB_OUTPUT} "repo=${repo2}\n")
-
-      - name: use cache
-        id: cache-ccache
-        uses: zephyrproject-rtos/action-s3-cache@v1.2.0
-        with:
-          key: ${{ steps.ccache_cache_prop.outputs.repo }}-${{github.event_name}}-${{matrix.platform}}-codecov-ccache
-          path: /github/home/.cache/ccache
-          aws-s3-bucket: ccache.zephyrproject.org
-          aws-access-key-id: ${{ vars.AWS_CCACHE_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_CCACHE_SECRET_ACCESS_KEY }}
-          aws-region: us-east-2
-
-      - name: ccache stats initial
-        run: |
-          mkdir -p /github/home/.cache
-          test -d github/home/.cache/ccache && mv github/home/.cache/ccache /github/home/.cache/ccache
-          ccache -M 10G -s
+          mkdir -p ${CCACHE_DIR}
+          ccache -M 10G
+          ccache -p
+          ccache -z -s -vv
 
       - name: Run Tests with Twister (Push)
         continue-on-error: true
@@ -90,12 +83,14 @@ jobs:
           export ZEPHYR_TOOLCHAIN_VARIANT=zephyr
           mkdir -p coverage/reports
           pip3 install gcovr==6.0
-          ./scripts/twister -i --force-color -N -v --filter runnable -p ${{ matrix.platform }} --coverage -T tests --coverage-tool gcovr -xCONFIG_TEST_EXTRA_STACK_SIZE=4096 -e nano
+          ./scripts/twister -i --force-color -N -v --filter runnable -p ${{ matrix.platform }} \
+            --coverage -T tests --coverage-tool gcovr -xCONFIG_TEST_EXTRA_STACK_SIZE=4096 -e nano \
+            --timeout-multiplier 2
 
-      - name: ccache stats post
+      - name: Print ccache stats
+        if: always()
         run: |
-          ccache -s
-          ccache -p
+          ccache -s -vv
 
       - name: Rename coverage files
         if: always()

.github/workflows/doc-build.yml.disabled

@@ -36,13 +36,29 @@ jobs:
   doc-build-html:
     name: "Documentation Build (HTML)"
     if: github.repository_owner == 'zephyrproject-rtos'
-    runs-on: zephyr-runner-linux-x64-4xlarge
+    runs-on:
+      group: zephyr-runner-v2-linux-x64-4xlarge
     timeout-minutes: 45
     concurrency:
       group: doc-build-html-${{ github.ref }}
       cancel-in-progress: true
 
     steps:
+    - name: Print cloud service information
+      run: |
+        echo "ZEPHYR_RUNNER_CLOUD_PROVIDER = ${ZEPHYR_RUNNER_CLOUD_PROVIDER}"
+        echo "ZEPHYR_RUNNER_CLOUD_NODE = ${ZEPHYR_RUNNER_CLOUD_NODE}"
+        echo "ZEPHYR_RUNNER_CLOUD_POD = ${ZEPHYR_RUNNER_CLOUD_POD}"
+
+    - name: install-pkgs
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y wget python3-pip git ninja-build graphviz lcov
+        wget --no-verbose "https://github.com/doxygen/doxygen/releases/download/Release_${DOXYGEN_VERSION//./_}/doxygen-${DOXYGEN_VERSION}.linux.bin.tar.gz"
+        sudo tar xf doxygen-${DOXYGEN_VERSION}.linux.bin.tar.gz -C /opt
+        echo "/opt/doxygen-${DOXYGEN_VERSION}/bin" >> $GITHUB_PATH
+        echo "${HOME}/.local/bin" >> $GITHUB_PATH
+
     - name: checkout
       uses: actions/checkout@v4
       with:
@@ -61,14 +77,6 @@ jobs:
         git rebase origin/${BASE_REF}
         git log --graph --oneline HEAD...${PR_HEAD}
 
-    - name: install-pkgs
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y ninja-build graphviz lcov
-        wget --no-verbose "https://github.com/doxygen/doxygen/releases/download/Release_${DOXYGEN_VERSION//./_}/doxygen-${DOXYGEN_VERSION}.linux.bin.tar.gz"
-        tar xf doxygen-${DOXYGEN_VERSION}.linux.bin.tar.gz
-        echo "${PWD}/doxygen-${DOXYGEN_VERSION}/bin" >> $GITHUB_PATH
-
     - name: cache-pip
       uses: actions/cache@v4
       with:
@@ -153,7 +161,8 @@ jobs:
     if: |
       github.event_name != 'pull_request' &&
       github.repository_owner == 'zephyrproject-rtos'
-    runs-on: zephyr-runner-linux-x64-4xlarge
+    runs-on:
+      group: zephyr-runner-v2-linux-x64-4xlarge
     container: texlive/texlive:latest
     timeout-minutes: 60
     concurrency:
@@ -165,6 +174,12 @@ jobs:
       run: |
         git config --global --add safe.directory ${GITHUB_WORKSPACE}
 
+    - name: Print cloud service information
+      run: |
+        echo "ZEPHYR_RUNNER_CLOUD_PROVIDER = ${ZEPHYR_RUNNER_CLOUD_PROVIDER}"
+        echo "ZEPHYR_RUNNER_CLOUD_NODE = ${ZEPHYR_RUNNER_CLOUD_NODE}"
+        echo "ZEPHYR_RUNNER_CLOUD_POD = ${ZEPHYR_RUNNER_CLOUD_POD}"
+
     - name: checkout
       uses: actions/checkout@v4
 

.github/workflows/footprint-tracking.yml.disabled

@@ -22,10 +22,11 @@ concurrency:
 
 jobs:
   footprint-tracking:
-    runs-on: zephyr-runner-linux-x64-4xlarge
+    runs-on:
+      group: zephyr-runner-v2-linux-x64-4xlarge
     if: github.repository_owner == 'zephyrproject-rtos'
     container:
-      image: ghcr.io/zephyrproject-rtos/ci:v0.26.7
+      image: ghcr.io/zephyrproject-rtos/ci-repo-cache:v0.26.7.20240313
       options: '--entrypoint /bin/bash'
     strategy:
       fail-fast: false
@@ -40,6 +41,12 @@ jobs:
           #        GitHub comes up with a fundamental fix for this problem.
           git config --global --add safe.directory ${GITHUB_WORKSPACE}
 
+      - name: Print cloud service information
+        run: |
+          echo "ZEPHYR_RUNNER_CLOUD_PROVIDER = ${ZEPHYR_RUNNER_CLOUD_PROVIDER}"
+          echo "ZEPHYR_RUNNER_CLOUD_NODE = ${ZEPHYR_RUNNER_CLOUD_NODE}"
+          echo "ZEPHYR_RUNNER_CLOUD_POD = ${ZEPHYR_RUNNER_CLOUD_POD}"
+
       - name: Update PATH for west
         run: |
           echo "$HOME/.local/bin" >> $GITHUB_PATH

.github/workflows/hello_world_multiplatform.yaml.disabled

@@ -68,7 +68,7 @@ jobs:
           elif [ "${{ runner.os }}" = "Windows" ]; then
             EXTRA_TWISTER_FLAGS="-P native_sim --short-build-path -O/tmp/twister-out"
           fi
-          ./scripts/twister --force-color --inline-logs -T samples/hello_world -v $EXTRA_TWISTER_FLAGS
+          ./scripts/twister --force-color --inline-logs -T samples/hello_world -T samples/cpp/hello_world -v $EXTRA_TWISTER_FLAGS
 
       - name: Upload artifacts
         if: failure()
@@ -77,3 +77,4 @@ jobs:
           if-no-files-found: ignore
           path:
             zephyr/twister-out/*/samples/hello_world/sample.basic.helloworld/build.log
+            zephyr/twister-out/*/samples/cpp/hello_world/sample.cpp.helloworld/build.log

.github/workflows/twister.yaml.disabled

@@ -22,19 +22,18 @@ concurrency:
 jobs:
   twister-build-prep:
     if: github.repository_owner == 'zephyrproject-rtos'
-    runs-on: zephyr-runner-linux-x64-4xlarge
+    runs-on:
+      group: zephyr-runner-v2-linux-x64-4xlarge
     container:
-      image: ghcr.io/zephyrproject-rtos/ci:v0.26.7
+      image: ghcr.io/zephyrproject-rtos/ci-repo-cache:v0.26.7.20240313
       options: '--entrypoint /bin/bash'
-      volumes:
-        - /repo-cache/zephyrproject:/github/cache/zephyrproject
     outputs:
       subset: ${{ steps.output-services.outputs.subset }}
       size: ${{ steps.output-services.outputs.size }}
       fullrun: ${{ steps.output-services.outputs.fullrun }}
     env:
       MATRIX_SIZE: 10
-      PUSH_MATRIX_SIZE: 15
+      PUSH_MATRIX_SIZE: 20
       DAILY_MATRIX_SIZE: 80
       BSIM_OUT_PATH: /opt/bsim/
       BSIM_COMPONENTS_PATH: /opt/bsim/components
@@ -50,11 +49,17 @@ jobs:
           #        GitHub comes up with a fundamental fix for this problem.
           git config --global --add safe.directory ${GITHUB_WORKSPACE}
 
+      - name: Print cloud service information
+        run: |
+          echo "ZEPHYR_RUNNER_CLOUD_PROVIDER = ${ZEPHYR_RUNNER_CLOUD_PROVIDER}"
+          echo "ZEPHYR_RUNNER_CLOUD_NODE = ${ZEPHYR_RUNNER_CLOUD_NODE}"
+          echo "ZEPHYR_RUNNER_CLOUD_POD = ${ZEPHYR_RUNNER_CLOUD_POD}"
+
       - name: Clone cached Zephyr repository
         if: github.event_name == 'pull_request_target'
         continue-on-error: true
         run: |
-          git clone --shared /github/cache/zephyrproject/zephyr .
+          git clone --shared /repo-cache/zephyrproject/zephyr .
           git remote set-url origin ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}
 
       - name: Checkout
@@ -76,7 +81,7 @@ jobs:
           west init -l . || true
           west config manifest.group-filter -- +ci,+optional
           west config --global update.narrow true
-          west update --path-cache /github/cache/zephyrproject 2>&1 1> west.update.log || west update --path-cache /github/cache/zephyrproject 2>&1 1> west.update.log || ( rm -rf ../modules ../bootloader ../tools && west update --path-cache /github/cache/zephyrproject)
+          west update --path-cache /repo-cache/zephyrproject 2>&1 1> west.update.log || west update --path-cache /repo-cache/zephyrproject 2>&1 1> west.update.log || ( rm -rf ../modules ../bootloader ../tools && west update --path-cache /repo-cache/zephyrproject)
           west forall -c 'git reset --hard HEAD'
 
           echo "ZEPHYR_SDK_INSTALL_DIR=/opt/toolchains/zephyr-sdk-$( cat SDK_VERSION )" >> $GITHUB_ENV
@@ -119,28 +124,39 @@ jobs:
           echo "fullrun=${TWISTER_FULL}" >> $GITHUB_OUTPUT
 
   twister-build:
-    runs-on: zephyr-runner-linux-x64-4xlarge
+    runs-on:
+      group: zephyr-runner-v2-linux-x64-4xlarge
     needs: twister-build-prep
     if: needs.twister-build-prep.outputs.size != 0
     container:
-      image: ghcr.io/zephyrproject-rtos/ci:v0.26.7
+      image: ghcr.io/zephyrproject-rtos/ci-repo-cache:v0.26.7.20240313
       options: '--entrypoint /bin/bash'
-      volumes:
-        - /repo-cache/zephyrproject:/github/cache/zephyrproject
     strategy:
       fail-fast: false
       matrix:
         subset: ${{fromJSON(needs.twister-build-prep.outputs.subset)}}
+    timeout-minutes: 1440
     env:
+      CCACHE_DIR: /node-cache/ccache-zephyr
+      CCACHE_REMOTE_STORAGE: "redis://cache-*.keydb-cache.svc.cluster.local|shards=1,2,3"
+      CCACHE_REMOTE_ONLY: "true"
+      # `--specs` is ignored because ccache is unable to resolve the toolchain specs file path.
+      CCACHE_IGNOREOPTIONS: '--specs=*'
       BSIM_OUT_PATH: /opt/bsim/
       BSIM_COMPONENTS_PATH: /opt/bsim/components
-      TWISTER_COMMON: ' --force-color --inline-logs -v -N -M --retry-failed 3 '
+      TWISTER_COMMON: ' --force-color --inline-logs -v -N -M --retry-failed 3 --timeout-multiplier 2 '
       DAILY_OPTIONS: ' -M --build-only --all --show-footprint'
       PR_OPTIONS: ' --clobber-output --integration'
       PUSH_OPTIONS: ' --clobber-output -M --show-footprint'
       COMMIT_RANGE: ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}
       BASE_REF: ${{ github.base_ref }}
     steps:
+      - name: Print cloud service information
+        run: |
+          echo "ZEPHYR_RUNNER_CLOUD_PROVIDER = ${ZEPHYR_RUNNER_CLOUD_PROVIDER}"
+          echo "ZEPHYR_RUNNER_CLOUD_NODE = ${ZEPHYR_RUNNER_CLOUD_NODE}"
+          echo "ZEPHYR_RUNNER_CLOUD_POD = ${ZEPHYR_RUNNER_CLOUD_POD}"
+
       - name: Apply container owner mismatch workaround
         run: |
           # FIXME: The owner UID of the GITHUB_WORKSPACE directory may not
@@ -152,7 +168,7 @@ jobs:
       - name: Clone cached Zephyr repository
         continue-on-error: true
         run: |
-          git clone --shared /github/cache/zephyrproject/zephyr .
+          git clone --shared /repo-cache/zephyrproject/zephyr .
           git remote set-url origin ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}
 
       - name: Checkout
@@ -176,15 +192,9 @@ jobs:
           west init -l . || true
           west config manifest.group-filter -- +ci,+optional
           west config --global update.narrow true
-          west update --path-cache /github/cache/zephyrproject 2>&1 1> west.update.log || west update --path-cache /github/cache/zephyrproject 2>&1 1> west.update.log || ( rm -rf ../modules ../bootloader ../tools && west update --path-cache /github/cache/zephyrproject)
+          west update --path-cache /repo-cache/zephyrproject 2>&1 1> west.update.log || west update --path-cache /repo-cache/zephyrproject 2>&1 1> west.update.log || ( rm -rf ../modules ../bootloader ../tools && west update --path-cache /repo-cache/zephyrproject)
           west forall -c 'git reset --hard HEAD'
 
-          # Hotfix until we have kitware ninja in the docker image.
-          # Needed for full functionality of the job server functionality in twister which only works with
-          # kitware supplied ninja version.
-          wget -c    https://github.com/Kitware/ninja/releases/download/v1.11.1.g95dee.kitware.jobserver-1/ninja-1.11.1.g95dee.kitware.jobserver-1_x86_64-linux-gnu.tar.gz -O - | tar xz --strip-components=1
-          sudo cp ninja /usr/local/bin
-
           echo "ZEPHYR_SDK_INSTALL_DIR=/opt/toolchains/zephyr-sdk-$( cat SDK_VERSION )" >> $GITHUB_ENV
 
       - name: Check Environment
@@ -196,32 +206,12 @@ jobs:
           echo "github.base_ref: ${{ github.base_ref }}"
           echo "github.ref_name: ${{ github.ref_name }}"
 
-      - name: Prepare ccache timestamp/data
-        id: ccache_cache_timestamp
-        shell: cmake -P {0}
+      - name: Set up ccache
         run: |
-          string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
-          string(REPLACE "/" "_" repo ${{github.repository}})
-          string(REPLACE "-" "_" repo2 ${repo})
-          file(APPEND $ENV{GITHUB_OUTPUT} "repo=${repo2}\n")
-
-      - name: use cache
-        id: cache-ccache
-        uses: zephyrproject-rtos/action-s3-cache@v1.2.0
-        continue-on-error: true
-        with:
-          key: ${{ steps.ccache_cache_timestamp.outputs.repo }}-${{ github.ref_name }}-${{github.event_name}}-${{ matrix.subset }}-ccache
-          path: /github/home/.cache/ccache
-          aws-s3-bucket: ccache.zephyrproject.org
-          aws-access-key-id: ${{ vars.AWS_CCACHE_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_CCACHE_SECRET_ACCESS_KEY }}
-          aws-region: us-east-2
-
-      - name: ccache stats initial
-        run: |
-          mkdir -p /github/home/.cache
-          test -d github/home/.cache/ccache && rm -rf /github/home/.cache/ccache && mv github/home/.cache/ccache /github/home/.cache/ccache
-          ccache -M 10G -s
+          mkdir -p ${CCACHE_DIR}
+          ccache -M 10G
+          ccache -p
+          ccache -z -s -vv
 
       - if: github.event_name == 'push'
         name: Run Tests with Twister (Push)
@@ -264,10 +254,10 @@ jobs:
             fi
           fi
 
-      - name: ccache stats post
+      - name: Print ccache stats
+        if: always()
         run: |
-          ccache -p
-          ccache -s
+          ccache -s -vv
 
       - name: Upload Unit Test Results
         if: always()

SDK_VERSION

@@ -1 +1 @@
-0.16.5
+0.16.9

cmake/modules/FindHostTools.cmake

@@ -50,7 +50,7 @@ endif()
 
 find_package(Deprecated COMPONENTS CROSS_COMPILE)
 
-find_package(Zephyr-sdk 0.16)
+find_package(Zephyr-sdk 0.16...<0.17)
 
 # gperf is an optional dependency
 find_program(GPERF gperf)

cmake/modules/FindZephyr-sdk.cmake

@@ -54,7 +54,7 @@ if(("zephyr" STREQUAL ${ZEPHYR_TOOLCHAIN_VARIANT}) OR
     # To support Zephyr SDK tools (DTC, and other tools) with 3rd party toolchains
     # then we keep track of current toolchain variant.
     set(ZEPHYR_CURRENT_TOOLCHAIN_VARIANT ${ZEPHYR_TOOLCHAIN_VARIANT})
-    find_package(Zephyr-sdk ${Zephyr-sdk_FIND_VERSION}
+    find_package(Zephyr-sdk ${Zephyr-sdk_FIND_VERSION_COMPLETE}
                  REQUIRED QUIET CONFIG HINTS ${ZEPHYR_SDK_INSTALL_DIR}
     )
     if(DEFINED ZEPHYR_CURRENT_TOOLCHAIN_VARIANT)
@@ -82,10 +82,20 @@ if(("zephyr" STREQUAL ${ZEPHYR_TOOLCHAIN_VARIANT}) OR
 
     list(REMOVE_DUPLICATES Zephyr-sdk_CONSIDERED_VERSIONS)
     list(SORT Zephyr-sdk_CONSIDERED_VERSIONS COMPARE NATURAL ORDER DESCENDING)
+    if("${Zephyr-sdk_FIND_VERSION_RANGE_MAX}" STREQUAL "INCLUDE")
+      set(upper_bound _EQUAL)
+    endif()
+
+    if(NOT DEFINED Zephyr-sdk_FIND_VERSION_RANGE)
+      # Range not given, max out to ensure max version is not in effect.
+      set(Zephyr-sdk_FIND_VERSION_MAX 99999999)
+    endif()
 
     # Loop over each found Zepher SDK version until one is found that is compatible.
     foreach(zephyr_sdk_candidate ${Zephyr-sdk_CONSIDERED_VERSIONS})
-      if("${zephyr_sdk_candidate}" VERSION_GREATER_EQUAL "${Zephyr-sdk_FIND_VERSION}")
+      if("${zephyr_sdk_candidate}" VERSION_GREATER_EQUAL "${Zephyr-sdk_FIND_VERSION}"
+         AND "${zephyr_sdk_candidate}" VERSION_LESS${upper_bound} "${Zephyr-sdk_FIND_VERSION_MAX}"
+      )
         # Find the path for the current version being checked and get the directory
         # of the Zephyr SDK so it can be checked.
         list(FIND zephyr_sdk_found_versions ${zephyr_sdk_candidate} zephyr_sdk_current_index)
@@ -93,7 +103,7 @@ if(("zephyr" STREQUAL ${ZEPHYR_TOOLCHAIN_VARIANT}) OR
         get_filename_component(zephyr_sdk_current_check_path ${zephyr_sdk_current_check_path} DIRECTORY)
 
         # Then see if this version is compatible.
-        find_package(Zephyr-sdk ${Zephyr-sdk_FIND_VERSION} QUIET CONFIG PATHS ${zephyr_sdk_current_check_path} NO_DEFAULT_PATH)
+        find_package(Zephyr-sdk ${Zephyr-sdk_FIND_VERSION_COMPLETE} QUIET CONFIG PATHS ${zephyr_sdk_current_check_path} NO_DEFAULT_PATH)
 
         if (${Zephyr-sdk_FOUND})
           # A compatible version of the Zephyr SDK has been found which is the highest
@@ -106,7 +116,7 @@ if(("zephyr" STREQUAL ${ZEPHYR_TOOLCHAIN_VARIANT}) OR
     if (NOT ${Zephyr-sdk_FOUND})
       # This means no compatible Zephyr SDK versions were found, set the version
       # back to the minimum version so that it is displayed in the error text.
-      find_package(Zephyr-sdk ${Zephyr-sdk_FIND_VERSION} REQUIRED CONFIG PATHS ${zephyr_sdk_search_paths})
+      find_package(Zephyr-sdk ${Zephyr-sdk_FIND_VERSION_COMPLETE} REQUIRED CONFIG PATHS ${zephyr_sdk_search_paths})
     endif()
   endif()
 

cmake/modules/configuration_files.cmake

@@ -45,7 +45,7 @@ endif()
 zephyr_get(CONF_FILE SYSBUILD LOCAL)
 if(NOT DEFINED CONF_FILE)
   zephyr_file(CONF_FILES ${APPLICATION_CONFIG_DIR} KCONF CONF_FILE NAMES "prj.conf" SUFFIX ${FILE_SUFFIX} REQUIRED)
-  zephyr_file(CONF_FILES ${APPLICATION_CONFIG_DIR}/boards KCONF CONF_FILE)
+  zephyr_file(CONF_FILES ${APPLICATION_CONFIG_DIR}/boards KCONF CONF_FILE SUFFIX ${FILE_SUFFIX})
 else()
   string(CONFIGURE "${CONF_FILE}" CONF_FILE_EXPANDED)
   string(REPLACE " " ";" CONF_FILE_AS_LIST "${CONF_FILE_EXPANDED}")
@@ -77,8 +77,12 @@ zephyr_file(CONF_FILES ${APPLICATION_CONFIG_DIR}/boards DTS APP_BOARD_DTS SUFFIX
 
 zephyr_get(DTC_OVERLAY_FILE SYSBUILD LOCAL)
 if(NOT DEFINED DTC_OVERLAY_FILE)
-  zephyr_file(CONF_FILES ${APPLICATION_CONFIG_DIR} DTS DTC_OVERLAY_FILE
-              NAMES "${APP_BOARD_DTS};${BOARD}.overlay;app.overlay" SUFFIX ${FILE_SUFFIX})
+  if(DEFINED APP_BOARD_DTS)
+    set(DTC_OVERLAY_FILE ${APP_BOARD_DTS})
+  else()
+    zephyr_file(CONF_FILES ${APPLICATION_CONFIG_DIR} DTS DTC_OVERLAY_FILE
+                NAMES "${BOARD}.overlay;app.overlay" SUFFIX ${FILE_SUFFIX})
+  endif()
 endif()
 
 set(DTC_OVERLAY_FILE ${DTC_OVERLAY_FILE} CACHE STRING "If desired, you can \

cmake/modules/extensions.cmake

@@ -2220,16 +2220,12 @@ function(toolchain_parse_make_rule input_file include_files)
   # the element separator, so let's get the pure `;` back.
   string(REPLACE "\;" ";" input_as_list ${input})
 
-  # Pop the first line and treat it specially
-  list(POP_FRONT input_as_list first_input_line)
-  string(FIND ${first_input_line} ": " index)
-  math(EXPR j "${index} + 2")
-  string(SUBSTRING ${first_input_line} ${j} -1 first_include_file)
+  # The file might also contain multiple files on one line if one or both of
+  # the file paths are short, split these up into multiple elements using regex
+  string(REGEX REPLACE "([^ ])[ ]([^ ])" "\\1;\\2" input_as_list "${input_as_list}")
 
-  # Remove whitespace before and after filename and convert to CMake path.
-  string(STRIP "${first_include_file}" first_include_file)
-  file(TO_CMAKE_PATH "${first_include_file}" first_include_file)
-  set(result "${first_include_file}")
+  # Pop the first item containing "empty_file.o:"
+  list(POP_FRONT input_as_list first_input_line)
 
   # Remove whitespace before and after filename and convert to CMake path.
   foreach(file ${input_as_list})
@@ -2481,76 +2477,76 @@ Please provide one of following: APPLICATION_ROOT, CONF_FILES")
     set(multi_args CONF_FILES NAMES)
   endif()
 
-  cmake_parse_arguments(FILE "${options}" "${single_args}" "${multi_args}" ${ARGN})
-  if(FILE_UNPARSED_ARGUMENTS)
-      message(FATAL_ERROR "zephyr_file(${ARGV0} <val> ...) given unknown arguments: ${FILE_UNPARSED_ARGUMENTS}")
+  cmake_parse_arguments(ZFILE "${options}" "${single_args}" "${multi_args}" ${ARGN})
+  if(ZFILE_UNPARSED_ARGUMENTS)
+      message(FATAL_ERROR "zephyr_file(${ARGV0} <val> ...) given unknown arguments: ${ZFILE_UNPARSED_ARGUMENTS}")
   endif()
 
-  if(FILE_APPLICATION_ROOT)
+  if(ZFILE_APPLICATION_ROOT)
     # Note: user can do: `-D<var>=<relative-path>` and app can at same
     # time specify `list(APPEND <var> <abs-path>)`
     # Thus need to check and update only CACHED variables (-D<var>).
-    set(CACHED_PATH $CACHE{${FILE_APPLICATION_ROOT}})
+    set(CACHED_PATH $CACHE{${ZFILE_APPLICATION_ROOT}})
     foreach(path ${CACHED_PATH})
       # The cached variable is relative path, i.e. provided by `-D<var>` or
       # `set(<var> CACHE)`, so let's update current scope variable to absolute
       # path from  `APPLICATION_SOURCE_DIR`.
       if(NOT IS_ABSOLUTE ${path})
         set(abs_path ${APPLICATION_SOURCE_DIR}/${path})
-        list(FIND ${FILE_APPLICATION_ROOT} ${path} index)
+        list(FIND ${ZFILE_APPLICATION_ROOT} ${path} index)
         if(NOT ${index} LESS 0)
-          list(REMOVE_AT ${FILE_APPLICATION_ROOT} ${index})
-          list(INSERT ${FILE_APPLICATION_ROOT} ${index} ${abs_path})
+          list(REMOVE_AT ${ZFILE_APPLICATION_ROOT} ${index})
+          list(INSERT ${ZFILE_APPLICATION_ROOT} ${index} ${abs_path})
         endif()
       endif()
     endforeach()
 
     # Now all cached relative paths has been updated.
     # Let's check if anyone uses relative path as scoped variable, and fail
-    foreach(path ${${FILE_APPLICATION_ROOT}})
+    foreach(path ${${ZFILE_APPLICATION_ROOT}})
       if(NOT IS_ABSOLUTE ${path})
         message(FATAL_ERROR
-"Relative path encountered in scoped variable: ${FILE_APPLICATION_ROOT}, value=${path}\n \
-Please adjust any `set(${FILE_APPLICATION_ROOT} ${path})` or `list(APPEND ${FILE_APPLICATION_ROOT} ${path})`\n \
+"Relative path encountered in scoped variable: ${ZFILE_APPLICATION_ROOT}, value=${path}\n \
+Please adjust any `set(${ZFILE_APPLICATION_ROOT} ${path})` or `list(APPEND ${ZFILE_APPLICATION_ROOT} ${path})`\n \
 to absolute path using `\${CMAKE_CURRENT_SOURCE_DIR}/${path}` or similar. \n \
 Relative paths are only allowed with `-D${ARGV1}=<path>`")
       endif()
     endforeach()
 
     # This updates the provided argument in parent scope (callers scope)
-    set(${FILE_APPLICATION_ROOT} ${${FILE_APPLICATION_ROOT}} PARENT_SCOPE)
+    set(${ZFILE_APPLICATION_ROOT} ${${ZFILE_APPLICATION_ROOT}} PARENT_SCOPE)
   endif()
 
-  if(FILE_CONF_FILES)
-    if(DEFINED FILE_BOARD_REVISION AND NOT FILE_BOARD)
+  if(ZFILE_CONF_FILES)
+    if(DEFINED ZFILE_BOARD_REVISION AND NOT ZFILE_BOARD)
         message(FATAL_ERROR
-          "zephyr_file(${ARGV0} <path> BOARD_REVISION ${FILE_BOARD_REVISION} ...)"
+          "zephyr_file(${ARGV0} <path> BOARD_REVISION ${ZFILE_BOARD_REVISION} ...)"
           " given without BOARD argument, please specify BOARD"
         )
     endif()
 
-    if(NOT DEFINED FILE_BOARD)
+    if(NOT DEFINED ZFILE_BOARD)
       # Defaulting to system wide settings when BOARD is not given as argument
-      set(FILE_BOARD ${BOARD})
+      set(ZFILE_BOARD ${BOARD})
       if(DEFINED BOARD_REVISION)
-        set(FILE_BOARD_REVISION ${BOARD_REVISION})
+        set(ZFILE_BOARD_REVISION ${BOARD_REVISION})
       endif()
     endif()
 
-    if(FILE_NAMES)
-      set(dts_filename_list ${FILE_NAMES})
-      set(kconf_filename_list ${FILE_NAMES})
+    if(ZFILE_NAMES)
+      set(dts_filename_list ${ZFILE_NAMES})
+      set(kconf_filename_list ${ZFILE_NAMES})
     else()
       zephyr_build_string(filename
-                          BOARD ${FILE_BOARD}
-                          BUILD ${FILE_BUILD}
+                          BOARD ${ZFILE_BOARD}
+                          BUILD ${ZFILE_BUILD}
       )
       set(filename_list ${filename})
 
       zephyr_build_string(filename
-                          BOARD ${FILE_BOARD}
-                          BOARD_REVISION ${FILE_BOARD_REVISION}
-                          BUILD ${FILE_BUILD}
+                          BOARD ${ZFILE_BOARD}
+                          BOARD_REVISION ${ZFILE_BOARD_REVISION}
+                          BUILD ${ZFILE_BUILD}
       )
       list(APPEND filename_list ${filename})
       list(REMOVE_DUPLICATES filename_list)
@@ -2561,24 +2557,24 @@ Relative paths are only allowed with `-D${ARGV1}=<path>`")
       list(TRANSFORM kconf_filename_list APPEND ".conf")
     endif()
 
-    if(FILE_DTS)
-      foreach(path ${FILE_CONF_FILES})
+    if(ZFILE_DTS)
+      foreach(path ${ZFILE_CONF_FILES})
         foreach(filename ${dts_filename_list})
           if(NOT IS_ABSOLUTE ${filename})
             set(test_file ${path}/${filename})
           else()
             set(test_file ${filename})
           endif()
-          zephyr_file_suffix(test_file SUFFIX ${FILE_SUFFIX})
+          zephyr_file_suffix(test_file SUFFIX ${ZFILE_SUFFIX})
 
           if(EXISTS ${test_file})
-            list(APPEND ${FILE_DTS} ${test_file})
+            list(APPEND ${ZFILE_DTS} ${test_file})
 
-            if(DEFINED FILE_BUILD)
+            if(DEFINED ZFILE_BUILD)
               set(deprecated_file_found y)
             endif()
 
-            if(FILE_NAMES)
+            if(ZFILE_NAMES)
               break()
             endif()
           endif()
@@ -2586,31 +2582,32 @@ Relative paths are only allowed with `-D${ARGV1}=<path>`")
       endforeach()
 
       # This updates the provided list in parent scope (callers scope)
-      set(${FILE_DTS} ${${FILE_DTS}} PARENT_SCOPE)
+      set(${ZFILE_DTS} ${${ZFILE_DTS}} PARENT_SCOPE)
 
-      if(NOT ${FILE_DTS})
+      if(NOT ${ZFILE_DTS})
         set(not_found ${dts_filename_list})
       endif()
     endif()
 
-    if(FILE_KCONF)
-      foreach(path ${FILE_CONF_FILES})
+    if(ZFILE_KCONF)
+      foreach(path ${ZFILE_CONF_FILES})
         foreach(filename ${kconf_filename_list})
           if(NOT IS_ABSOLUTE ${filename})
             set(test_file ${path}/${filename})
           else()
             set(test_file ${filename})
           endif()
-          zephyr_file_suffix(test_file SUFFIX ${FILE_SUFFIX})
+
+          zephyr_file_suffix(test_file SUFFIX ${ZFILE_SUFFIX})
 
           if(EXISTS ${test_file})
-            list(APPEND ${FILE_KCONF} ${test_file})
+            list(APPEND ${ZFILE_KCONF} ${test_file})
 
-            if(DEFINED FILE_BUILD)
+            if(DEFINED ZFILE_BUILD)
               set(deprecated_file_found y)
             endif()
 
-            if(FILE_NAMES)
+            if(ZFILE_NAMES)
               break()
             endif()
           endif()
@@ -2618,16 +2615,16 @@ Relative paths are only allowed with `-D${ARGV1}=<path>`")
       endforeach()
 
       # This updates the provided list in parent scope (callers scope)
-      set(${FILE_KCONF} ${${FILE_KCONF}} PARENT_SCOPE)
+      set(${ZFILE_KCONF} ${${ZFILE_KCONF}} PARENT_SCOPE)
 
-      if(NOT ${FILE_KCONF})
+      if(NOT ${ZFILE_KCONF})
         set(not_found ${kconf_filename_list})
       endif()
     endif()
 
-    if(FILE_REQUIRED AND DEFINED not_found)
+    if(ZFILE_REQUIRED AND DEFINED not_found)
       message(FATAL_ERROR
-              "No ${not_found} file(s) was found in the ${FILE_CONF_FILES} folder(s), "
+              "No ${not_found} file(s) was found in the ${ZFILE_CONF_FILES} folder(s), "
               "please read the Zephyr documentation on application development."
       )
     endif()
@@ -2691,9 +2688,9 @@ endfunction()
 #
 function(zephyr_file_suffix filename)
   set(single_args SUFFIX)
-  cmake_parse_arguments(FILE "" "${single_args}" "" ${ARGN})
+  cmake_parse_arguments(SFILE "" "${single_args}" "" ${ARGN})
 
-  if(NOT DEFINED FILE_SUFFIX OR NOT DEFINED ${filename})
+  if(NOT DEFINED SFILE_SUFFIX OR NOT DEFINED ${filename})
     # If the file suffix variable is not known then there is nothing to do, return early
     return()
   endif()
@@ -2709,7 +2706,7 @@ function(zephyr_file_suffix filename)
     # Search for the full stop so we know where to add the file suffix before the file extension
     cmake_path(GET file EXTENSION file_ext)
     cmake_path(REMOVE_EXTENSION file OUTPUT_VARIABLE new_filename)
-    cmake_path(APPEND_STRING new_filename "_${FILE_SUFFIX}${file_ext}")
+    cmake_path(APPEND_STRING new_filename "_${SFILE_SUFFIX}${file_ext}")
 
     # Use the filename with the suffix if it exists, if not then fall back to the default
     if(EXISTS "${new_filename}")

cmake/modules/version.cmake

@@ -36,8 +36,12 @@
 # The final load of `version.cmake` will setup correct build version values.
 
 if(NOT DEFINED VERSION_FILE AND NOT DEFINED VERSION_TYPE)
-  set(VERSION_FILE ${ZEPHYR_BASE}/VERSION ${APPLICATION_SOURCE_DIR}/VERSION)
-  set(VERSION_TYPE KERNEL                 APP)
+  set(VERSION_FILE ${ZEPHYR_BASE}/VERSION)
+  set(VERSION_TYPE KERNEL)
+  if(DEFINED APPLICATION_SOURCE_DIR)
+    list(APPEND VERSION_FILE ${APPLICATION_SOURCE_DIR}/VERSION)
+    list(APPEND VERSION_TYPE APP)
+  endif()
 endif()
 
 foreach(type file IN ZIP_LISTS VERSION_TYPE VERSION_FILE)

doc/_templates/searchbox.html

@@ -57,6 +57,7 @@
       .getElementById("search-se-settings-icon")
       .setAttribute("aria-expanded", visible ? "true" : "false");
   };
+  setSearchEngineSettingsMenuVisibility(false);
 
   window.toggleSearchEngineSettingsMenu = function () {
     isVisible = searchMenu.style.display === "block";

doc/releases/migration-guide-3.6.rst

@@ -46,6 +46,9 @@ Kernel
   :kconfig:option:`CONFIG_HEAP_MEM_POOL_IGNORE_MIN` option has been introduced (which defaults
   being disabled).
 
+* STM32H7 and STM32F7 should now activate the cache (Icache and Dcache) by setting explicitly
+  the  ``CONFIG_CACHE_MANAGEMENT`` to ``y``.
+
 Boards
 ******
 
@@ -638,7 +641,7 @@ Shell
 * :kconfig:option:`CONFIG_SHELL_BACKEND_SERIAL_API` now does not automatically default to
   :kconfig:option:`CONFIG_SHELL_BACKEND_SERIAL_API_ASYNC` when
   :kconfig:option:`CONFIG_UART_ASYNC_API` is enabled, :kconfig:option:`CONFIG_SHELL_ASYNC_API`
-  also has to be enabled in order to use the asynchronous serial shell (:github: `68475`).
+  also has to be enabled in order to use the asynchronous serial shell (:github:`68475`).
 
 ZBus
 ====

doc/services/device_mgmt/mcumgr.rst

@@ -48,26 +48,26 @@ project.
     .. table:: Tools and Libraries for MCUmgr
         :align: center
 
-        +--------------------------------------------------------------------------------+-------------------------------------------+--------------------------+--------------------------------------------------+---------------+------------+---------+
-        | Name                                                                           | OS support                                | Transports               | Groups                                           | Type          | Language   | License |
-        |                                                                                +---------+-------+-----+--------+----------+--------+-----------+-----+----+-----+------+----------+----+-------+--------+               |            |         |
-        |                                                                                | Windows | Linux | mac | Mobile | Embedded | Serial | Bluetooth | UDP | OS | IMG | Stat | Settings | FS | Shell | Zephyr |               |            |         |
-        +================================================================================+=========+=======+=====+========+==========+========+===========+=====+====+=====+======+==========+====+=======+========+===============+============+=========+
-        | `AuTerm <https://github.com/thedjnK/AuTerm/>`_                                 | ✓       | ✓     | ✓   | ✕      | ✕        | ✓      | ✓         | ✓   | ✓  | ✓   | ✓    | ✓        | ✓  | ✓     | ✓      | Application   | C++ (Qt)   | GPLv3   |
-        +--------------------------------------------------------------------------------+---------+-------+-----+--------+----------+--------+-----------+-----+----+-----+------+----------+----+-------+--------+---------------+------------+---------+
-        | `mcumgr-client <https://github.com/vouch-opensource/mcumgr-client/>`_          | ✓       | ✓     | ✓   | ✕      | ✕        | ✓      | ✕         | ✕   | ✕  | ✓   | ✕    | ✕        | ✕  | ✕     | ✕      | Application   | Rust       | BSD     |
-        +--------------------------------------------------------------------------------+---------+-------+-----+--------+----------+--------+-----------+-----+----+-----+------+----------+----+-------+--------+---------------+------------+---------+
-        | `mcumgr-web <https://github.com/boogie/mcumgr-web/>`_                          | ✓       | ✓     | ✓   | ✕      | ✕        | ✕      | ✓         | ✕   | ✕  | ✓   | ✕    | ✕        | ✕  | ✕     | ✕      | Web page      | Javascript | MIT     |
-        |                                                                                |         |       |     |        |          |        |           |     |    |     |      |          |    |       |        | (chrome only) |            |         |
-        +--------------------------------------------------------------------------------+---------+-------+-----+--------+----------+--------+-----------+-----+----+-----+------+----------+----+-------+--------+---------------+------------+---------+
-        | nRF Connect Device Manager: |br|                                               |         |       |     |        |          |        |           |     |    |     |      |          |    |       |        |               |            |         |
-        | `Android                                                                       | ✕       | ✕     | ✕   | ✓      | ✕        | ✕      | ✓         | ✕   | ✓  | ✓   | ✓    | ✓        | ✓  | ✓     | ✓      | Library and   | Java,      | Apache  |
-        | <https://github.com/NordicSemiconductor/Android-nRF-Connect-Device-Manager/>`_ |         |       |     |        |          |        |           |     |    |     |      |          |    |       |        | application   | Kotlin,    |         |
-        | and `iOS                                                                       |         |       |     |        |          |        |           |     |    |     |      |          |    |       |        |               | Swift      |         |
-        | <https://github.com/NordicSemiconductor/IOS-nRF-Connect-Device-Manager>`_      |         |       |     |        |          |        |           |     |    |     |      |          |    |       |        |               |            |         |
-        +--------------------------------------------------------------------------------+---------+-------+-----+--------+----------+--------+-----------+-----+----+-----+------+----------+----+-------+--------+---------------+------------+---------+
-        | Zephyr MCUmgr client (in-tree)                                                 | ✕       | ✓     | ✕   | ✕      | ✓        | ✓      | ✓         | ✓   | ✓  | ✓   | ✕    | ✕        | ✕  | ✕     | ✕      | Library       | C          | Apache  |
-        +--------------------------------------------------------------------------------+---------+-------+-----+--------+----------+--------+-----------+-----+----+-----+------+----------+----+-------+--------+---------------+------------+---------+
+        +--------------------------------------------------------------------------------+-------------------------------------------+--------------------------+--------------------------------------------------+---------------+------------+------------+
+        | Name                                                                           | OS support                                | Transports               | Groups                                           | Type          | Language   | License    |
+        |                                                                                +---------+-------+-----+--------+----------+--------+-----------+-----+----+-----+------+----------+----+-------+--------+               |            |            |
+        |                                                                                | Windows | Linux | mac | Mobile | Embedded | Serial | Bluetooth | UDP | OS | IMG | Stat | Settings | FS | Shell | Zephyr |               |            |            |
+        +================================================================================+=========+=======+=====+========+==========+========+===========+=====+====+=====+======+==========+====+=======+========+===============+============+============+
+        | `AuTerm <https://github.com/thedjnK/AuTerm/>`_                                 | ✓       | ✓     | ✓   | ✕      | ✕        | ✓      | ✓         | ✓   | ✓  | ✓   | ✓    | ✓        | ✓  | ✓     | ✓      | Application   | C++ (Qt)   | GPL-3.0    |
+        +--------------------------------------------------------------------------------+---------+-------+-----+--------+----------+--------+-----------+-----+----+-----+------+----------+----+-------+--------+---------------+------------+------------+
+        | `mcumgr-client <https://github.com/vouch-opensource/mcumgr-client/>`_          | ✓       | ✓     | ✓   | ✕      | ✕        | ✓      | ✕         | ✕   | ✕  | ✓   | ✕    | ✕        | ✕  | ✕     | ✕      | Application   | Rust       | Apache-2.0 |
+        +--------------------------------------------------------------------------------+---------+-------+-----+--------+----------+--------+-----------+-----+----+-----+------+----------+----+-------+--------+---------------+------------+------------+
+        | `mcumgr-web <https://github.com/boogie/mcumgr-web/>`_                          | ✓       | ✓     | ✓   | ✕      | ✕        | ✕      | ✓         | ✕   | ✕  | ✓   | ✕    | ✕        | ✕  | ✕     | ✕      | Web page      | Javascript | MIT        |
+        |                                                                                |         |       |     |        |          |        |           |     |    |     |      |          |    |       |        | (chrome only) |            |            |
+        +--------------------------------------------------------------------------------+---------+-------+-----+--------+----------+--------+-----------+-----+----+-----+------+----------+----+-------+--------+---------------+------------+------------+
+        | nRF Connect Device Manager: |br|                                               |         |       |     |        |          |        |           |     |    |     |      |          |    |       |        |               |            |            |
+        | `Android                                                                       | ✕       | ✕     | ✕   | ✓      | ✕        | ✕      | ✓         | ✕   | ✓  | ✓   | ✓    | ✓        | ✓  | ✓     | ✓      | Library and   | Java,      | Apache-2.0 |
+        | <https://github.com/NordicSemiconductor/Android-nRF-Connect-Device-Manager/>`_ |         |       |     |        |          |        |           |     |    |     |      |          |    |       |        | application   | Kotlin,    |            |
+        | and `iOS                                                                       |         |       |     |        |          |        |           |     |    |     |      |          |    |       |        |               | Swift      |            |
+        | <https://github.com/NordicSemiconductor/IOS-nRF-Connect-Device-Manager>`_      |         |       |     |        |          |        |           |     |    |     |      |          |    |       |        |               |            |            |
+        +--------------------------------------------------------------------------------+---------+-------+-----+--------+----------+--------+-----------+-----+----+-----+------+----------+----+-------+--------+---------------+------------+------------+
+        | Zephyr MCUmgr client (in-tree)                                                 | ✕       | ✓     | ✕   | ✕      | ✓        | ✓      | ✓         | ✓   | ✓  | ✓   | ✕    | ✕        | ✕  | ✕     | ✕      | Library       | C          | Apache-2.0 |
+        +--------------------------------------------------------------------------------+---------+-------+-----+--------+----------+--------+-----------+-----+----+-----+------+----------+----+-------+--------+---------------+------------+------------+
 
 .. only:: latex
 

drivers/adc/adc_lmp90xxx.c

@@ -639,7 +639,7 @@ static int lmp90xxx_adc_read_channel(const struct device *dev,
 		if (buf[3] != crc) {
 			LOG_ERR("CRC mismatch (0x%02x vs. 0x%02x)", buf[3],
 				crc);
-			return err;
+			return -EIO;
 		}
 	}
 

drivers/bluetooth/hci/ipc.c

@@ -229,19 +229,7 @@ static void bt_ipc_rx(const uint8_t *data, size_t len)
 
 	if (buf) {
 		LOG_DBG("Calling bt_recv(%p)", buf);
-
-		/* The IPC service does not guarantee that the handler thread
-		 * is cooperative. In particular, the OpenAMP implementation is
-		 * preemtible by default. OTOH, the HCI driver interface requires
-		 * that the bt_recv() function is called from a cooperative
-		 * thread.
-		 *
-		 * Calling `k_sched lock()` has the effect of making the current
-		 * thread cooperative.
-		 */
-		k_sched_lock();
 		bt_recv(buf);
-		k_sched_unlock();
 
 		LOG_HEXDUMP_DBG(buf->data, buf->len, "RX buf payload:");
 	}

drivers/can/Kconfig.mcan

@@ -1,4 +1,4 @@
-# Bosch m_can configuration options
+# Bosch M_CAN configuration options
 
 # Copyright (c) 2020 Alexander Wachter
 # SPDX-License-Identifier: Apache-2.0
@@ -6,17 +6,4 @@
 config CAN_MCAN
 	bool
 	help
-	  Enable Bosch m_can driver.
-	  This driver supports the Bosch m_can IP. This IP is built into the
-	  STM32G4, STM32G0, STM32H7, and the Microchip SAM controllers with
-	  CAN FD.
-
-if CAN_MCAN
-
-config CAN_DELAY_COMP
-	bool "Transceiver delay compensation"
-	default y
-	help
-	  Enable the automatic transceiver delay compensation.
-
-endif #CAN_MCAN
+	  Enable the Bosch M_CAN CAN IP module driver backend.

drivers/can/can_mcan.c

@@ -225,8 +225,10 @@ unlock:
 #ifdef CONFIG_CAN_FD_MODE
 int can_mcan_set_timing_data(const struct device *dev, const struct can_timing *timing_data)
 {
+	const uint8_t tdco_max = FIELD_GET(CAN_MCAN_TDCR_TDCO, CAN_MCAN_TDCR_TDCO);
 	struct can_mcan_data *data = dev->data;
 	uint32_t dbtp = 0U;
+	uint8_t tdco;
 	int err;
 
 	if (data->common.started) {
@@ -240,6 +242,23 @@ int can_mcan_set_timing_data(const struct device *dev, const struct can_timing *
 		FIELD_PREP(CAN_MCAN_DBTP_DTSEG2, timing_data->phase_seg2 - 1UL) |
 		FIELD_PREP(CAN_MCAN_DBTP_DBRP, timing_data->prescaler - 1UL);
 
+	if (timing_data->prescaler == 1U || timing_data->prescaler == 2U) {
+		/* TDC can only be enabled if DBRP = { 0, 1 } */
+		dbtp |= CAN_MCAN_DBTP_TDC;
+
+		/* Set TDC offset for correct location of the Secondary Sample Point (SSP) */
+		tdco = CAN_CALC_TDCO(timing_data, 0U, tdco_max);
+		LOG_DBG("TDC enabled, using TDCO %u", tdco);
+
+		err = can_mcan_write_reg(dev, CAN_MCAN_TDCR, FIELD_PREP(CAN_MCAN_TDCR_TDCO, tdco));
+		if (err != 0) {
+			goto unlock;
+		}
+	} else {
+		LOG_DBG("TDC cannot be enabled, prescaler value %u too high",
+			timing_data->prescaler);
+	}
+
 	err = can_mcan_write_reg(dev, CAN_MCAN_DBTP, dbtp);
 	if (err != 0) {
 		goto unlock;
@@ -1416,32 +1435,6 @@ int can_mcan_init(const struct device *dev)
 		return err;
 	}
 
-#if defined(CONFIG_CAN_DELAY_COMP) && defined(CONFIG_CAN_FD_MODE)
-	err = can_mcan_read_reg(dev, CAN_MCAN_DBTP, &reg);
-	if (err != 0) {
-		return err;
-	}
-
-	reg |= CAN_MCAN_DBTP_TDC;
-
-	err = can_mcan_write_reg(dev, CAN_MCAN_DBTP, reg);
-	if (err != 0) {
-		return err;
-	}
-
-	err = can_mcan_read_reg(dev, CAN_MCAN_TDCR, &reg);
-	if (err != 0) {
-		return err;
-	}
-
-	reg |= FIELD_PREP(CAN_MCAN_TDCR_TDCO, config->tx_delay_comp_offset);
-
-	err = can_mcan_write_reg(dev, CAN_MCAN_TDCR, reg);
-	if (err != 0) {
-		return err;
-	}
-#endif /* defined(CONFIG_CAN_DELAY_COMP) && defined(CONFIG_CAN_FD_MODE) */
-
 	err = can_mcan_read_reg(dev, CAN_MCAN_GFC, &reg);
 	if (err != 0) {
 		return err;

drivers/can/can_native_linux.c

@@ -240,7 +240,7 @@ static void can_native_linux_remove_rx_filter(const struct device *dev, int filt
 	struct can_native_linux_data *data = dev->data;
 
 	if (filter_id < 0 || filter_id >= ARRAY_SIZE(data->filters)) {
-		LOG_ERR("filter ID %d out of bounds");
+		LOG_ERR("filter ID %d out of bounds", filter_id);
 		return;
 	}
 

drivers/can/can_shell.c

@@ -676,7 +676,7 @@ static int cmd_can_send(const struct shell *sh, size_t argc, char **argv)
 	const struct device *dev = device_get_binding(argv[1]);
 	static unsigned int frame_counter;
 	unsigned int frame_no;
-	struct can_frame frame;
+	struct can_frame frame = { 0 };
 	uint32_t max_id;
 	int argidx = 2;
 	uint32_t val;
@@ -781,7 +781,7 @@ static int cmd_can_send(const struct shell *sh, size_t argc, char **argv)
 		    (frame.flags & CAN_FRAME_RTR) != 0 ? 1 : 0,
 		    (frame.flags & CAN_FRAME_FDF) != 0 ? 1 : 0,
 		    (frame.flags & CAN_FRAME_BRS) != 0 ? 1 : 0,
-		    can_dlc_to_bytes(frame.dlc));
+		    frame.dlc);
 
 	err = can_send(dev, &frame, K_NO_WAIT, can_shell_tx_callback, UINT_TO_POINTER(frame_no));
 	if (err != 0) {

drivers/counter/counter_ll_stm32_rtc.c

@@ -191,7 +191,7 @@ static int rtc_stm32_start(const struct device *dev)
 
 	/* Enable RTC bus clock */
 	if (clock_control_on(clk, (clock_control_subsys_t) &cfg->pclken[0]) != 0) {
-		LOG_ERR("clock op failed\n");
+		LOG_ERR("RTC clock enabling failed\n");
 		return -EIO;
 	}
 #else
@@ -212,9 +212,9 @@ static int rtc_stm32_stop(const struct device *dev)
 	const struct device *const clk = DEVICE_DT_GET(STM32_CLOCK_CONTROL_NODE);
 	const struct rtc_stm32_config *cfg = dev->config;
 
-	/* Enable RTC bus clock */
-	if (clock_control_on(clk, (clock_control_subsys_t) &cfg->pclken[0]) != 0) {
-		LOG_ERR("clock op failed\n");
+	/* Disable RTC bus clock */
+	if (clock_control_off(clk, (clock_control_subsys_t) &cfg->pclken[0]) != 0) {
+		LOG_ERR("RTC clock disabling failed\n");
 		return -EIO;
 	}
 #else

drivers/counter/counter_nrfx_timer.c

@@ -28,6 +28,12 @@ LOG_MODULE_REGISTER(LOG_MODULE_NAME, LOG_LEVEL);
 #define COUNTER_OVERFLOW_SHORT NRF_TIMER_SHORT_COMPARE0_CLEAR_MASK
 #define COUNTER_READ_CC NRF_TIMER_CC_CHANNEL1
 
+#if defined(CONFIG_SOC_SERIES_BSIM_NRFXX)
+#define MAYBE_CONST_CONFIG
+#else
+#define MAYBE_CONST_CONFIG const
+#endif
+
 struct counter_nrfx_data {
 	counter_top_callback_t top_cb;
 	void *top_user_data;
@@ -283,7 +289,16 @@ static uint32_t get_pending_int(const struct device *dev)
 static int init_timer(const struct device *dev,
 		      const struct counter_timer_config *config)
 {
-	const struct counter_nrfx_config *nrfx_config = dev->config;
+	MAYBE_CONST_CONFIG struct counter_nrfx_config *nrfx_config =
+			(MAYBE_CONST_CONFIG struct counter_nrfx_config *)dev->config;
+
+#if defined(CONFIG_SOC_SERIES_BSIM_NRFXX)
+	/* For simulated devices we need to convert the hardcoded DT address from the real
+	 * peripheral into the correct one for simulation
+	 */
+	nrfx_config->timer = nhw_convert_periph_base_addr(nrfx_config->timer);
+#endif
+
 	NRF_TIMER_Type *reg = nrfx_config->timer;
 
 	nrf_timer_bit_width_set(reg, config->bit_width);
@@ -430,7 +445,7 @@ static const struct counter_driver_api counter_nrfx_driver_api = {
 	static struct counter_nrfx_ch_data							\
 		counter##idx##_ch_data[CC_TO_ID(DT_INST_PROP(idx, cc_num))];			\
 	LOG_INSTANCE_REGISTER(LOG_MODULE_NAME, idx, CONFIG_COUNTER_LOG_LEVEL);			\
-	static const struct counter_nrfx_config nrfx_counter_##idx##_config = {			\
+	static MAYBE_CONST_CONFIG struct counter_nrfx_config nrfx_counter_##idx##_config = {	\
 		.info = {									\
 			.max_top_value = (uint32_t)BIT64_MASK(DT_INST_PROP(idx, max_bit_width)),\
 			.freq = TIMER_CLOCK((NRF_TIMER_Type *)DT_INST_REG_ADDR(idx)) /		\
@@ -439,7 +454,7 @@ static const struct counter_driver_api counter_nrfx_driver_api = {
 			.channels = CC_TO_ID(DT_INST_PROP(idx, cc_num)),			\
 		},										\
 		.ch_data = counter##idx##_ch_data,						\
-		.timer = (NRF_TIMER_Type *)_CONCAT(NRF_TIMER, idx),				\
+		.timer = (NRF_TIMER_Type *)DT_INST_REG_ADDR(idx),				\
 		LOG_INSTANCE_PTR_INIT(log, LOG_MODULE_NAME, idx)				\
 	};											\
 	DEVICE_DT_INST_DEFINE(idx,								\

drivers/dac/dac_esp32.c

@@ -66,7 +66,7 @@ static int dac_esp32_init(const struct device *dev)
 	}
 
 	if (clock_control_on(cfg->clock_dev,
-		(clock_control_subsys_t) &cfg->clock_subsys) != 0) {
+		(clock_control_subsys_t) cfg->clock_subsys) != 0) {
 		LOG_ERR("DAC clock setup failed (%d)", -EIO);
 		return -EIO;
 	}

drivers/flash/flash_stm32_ospi.c

@@ -1092,11 +1092,11 @@ static int flash_stm32_ospi_erase(const struct device *dev, off_t addr,
 							? SPI_NOR_CMD_SE_4B
 							: SPI_NOR_CMD_SE;
 					}
-					/* Avoid using wrong erase type,
-					 * if zero entries are found in erase_types
-					 */
-					bet = NULL;
 				}
+				/* Avoid using wrong erase type,
+				 * if zero entries are found in erase_types
+				 */
+				bet = NULL;
 			}
 			LOG_INF("Sector/Block Erase addr 0x%x, asize 0x%x amode 0x%x  instr 0x%x",
 				cmd_erase.Address, cmd_erase.AddressSize,

drivers/input/input_gpio_keys.c

@@ -207,51 +207,59 @@ static int gpio_keys_pm_action(const struct device *dev,
 	const struct gpio_keys_config *cfg = dev->config;
 	struct gpio_keys_data *data = dev->data;
 	struct gpio_keys_pin_data *pin_data = cfg->pin_data;
-	gpio_flags_t gpio_flags;
-	gpio_flags_t int_flags;
 	int ret;
 
 	switch (action) {
 	case PM_DEVICE_ACTION_SUSPEND:
-		gpio_flags = GPIO_DISCONNECTED;
-		int_flags = GPIO_INT_DISABLE;
 		atomic_set(&data->suspended, 1);
-		break;
+
+		for (int i = 0; i < cfg->num_keys; i++) {
+			const struct gpio_dt_spec *gpio = &cfg->pin_cfg[i].spec;
+
+			if (!cfg->polling_mode) {
+				ret = gpio_pin_interrupt_configure_dt(gpio, GPIO_INT_DISABLE);
+				if (ret < 0) {
+					LOG_ERR("interrupt configuration failed: %d", ret);
+					return ret;
+				}
+			}
+
+			ret = gpio_pin_configure_dt(gpio, GPIO_DISCONNECTED);
+			if (ret != 0) {
+				LOG_ERR("Pin %d configuration failed: %d", i, ret);
+				return ret;
+			}
+		}
+
+		return 0;
 	case PM_DEVICE_ACTION_RESUME:
-		gpio_flags = GPIO_INPUT;
-		int_flags = GPIO_INT_EDGE_BOTH;
 		atomic_set(&data->suspended, 0);
-		break;
+
+		for (int i = 0; i < cfg->num_keys; i++) {
+			const struct gpio_dt_spec *gpio = &cfg->pin_cfg[i].spec;
+
+			ret = gpio_pin_configure_dt(gpio, GPIO_INPUT);
+			if (ret != 0) {
+				LOG_ERR("Pin %d configuration failed: %d", i, ret);
+				return ret;
+			}
+
+			if (cfg->polling_mode) {
+				k_work_reschedule(&pin_data[0].work,
+						  K_MSEC(cfg->debounce_interval_ms));
+			} else {
+				ret = gpio_pin_interrupt_configure_dt(gpio, GPIO_INT_EDGE_BOTH);
+				if (ret < 0) {
+					LOG_ERR("interrupt configuration failed: %d", ret);
+					return ret;
+				}
+			}
+		}
+
+		return 0;
 	default:
 		return -ENOTSUP;
 	}
-
-	for (int i = 0; i < cfg->num_keys; i++) {
-		const struct gpio_dt_spec *gpio = &cfg->pin_cfg[i].spec;
-
-		ret = gpio_pin_configure_dt(gpio, gpio_flags);
-		if (ret != 0) {
-			LOG_ERR("Pin %d configuration failed: %d", i, ret);
-			return ret;
-		}
-
-		if (cfg->polling_mode) {
-			continue;
-		}
-
-		ret = gpio_pin_interrupt_configure_dt(gpio, int_flags);
-		if (ret < 0) {
-			LOG_ERR("interrupt configuration failed: %d", ret);
-			return ret;
-		}
-	}
-
-	if (action == PM_DEVICE_ACTION_RESUME && cfg->polling_mode) {
-		k_work_reschedule(&pin_data[0].work,
-				  K_MSEC(cfg->debounce_interval_ms));
-	}
-
-	return 0;
 }
 #endif
 

drivers/mipi_dbi/mipi_dbi_spi.c

@@ -25,7 +25,7 @@ struct mipi_dbi_spi_config {
 struct mipi_dbi_spi_data {
 	/* Used for 3 wire mode */
 	uint16_t spi_byte;
-	struct k_spinlock lock;
+	struct k_mutex lock;
 };
 
 /* Expands to 1 if the node does not have the `write-only` property */
@@ -58,7 +58,11 @@ static int mipi_dbi_spi_write_helper(const struct device *dev,
 		.count = 1,
 	};
 	int ret = 0;
-	k_spinlock_key_t spinlock_key = k_spin_lock(&data->lock);
+
+	ret = k_mutex_lock(&data->lock, K_FOREVER);
+	if (ret < 0) {
+		return ret;
+	}
 
 	if (dbi_config->mode == MIPI_DBI_MODE_SPI_3WIRE &&
 	    IS_ENABLED(CONFIG_MIPI_DBI_SPI_3WIRE)) {
@@ -124,7 +128,7 @@ static int mipi_dbi_spi_write_helper(const struct device *dev,
 		ret = -ENOTSUP;
 	}
 out:
-	k_spin_unlock(&data->lock, spinlock_key);
+	k_mutex_unlock(&data->lock);
 	return ret;
 }
 
@@ -164,9 +168,12 @@ static int mipi_dbi_spi_command_read(const struct device *dev,
 		.count = 1,
 	};
 	int ret = 0;
-	k_spinlock_key_t spinlock_key = k_spin_lock(&data->lock);
 	struct spi_config tmp_config;
 
+	ret = k_mutex_lock(&data->lock, K_FOREVER);
+	if (ret < 0) {
+		return ret;
+	}
 	memcpy(&tmp_config, &dbi_config->config, sizeof(tmp_config));
 	if (dbi_config->mode == MIPI_DBI_MODE_SPI_3WIRE &&
 	    IS_ENABLED(CONFIG_MIPI_DBI_SPI_3WIRE)) {
@@ -231,7 +238,7 @@ static int mipi_dbi_spi_command_read(const struct device *dev,
 	}
 out:
 	spi_release(config->spi_dev, &tmp_config);
-	k_spin_unlock(&data->lock, spinlock_key);
+	k_mutex_unlock(&data->lock);
 	return ret;
 }
 
@@ -262,6 +269,7 @@ static int mipi_dbi_spi_reset(const struct device *dev, uint32_t delay)
 static int mipi_dbi_spi_init(const struct device *dev)
 {
 	const struct mipi_dbi_spi_config *config = dev->config;
+	struct mipi_dbi_spi_data *data = dev->data;
 	int ret;
 
 	if (!device_is_ready(config->spi_dev)) {
@@ -291,6 +299,8 @@ static int mipi_dbi_spi_init(const struct device *dev)
 		}
 	}
 
+	k_mutex_init(&data->lock);
+
 	return 0;
 }
 

drivers/sensor/ams_as5600/ams_as5600.c

@@ -19,6 +19,7 @@ LOG_MODULE_REGISTER(ams_as5600, CONFIG_SENSOR_LOG_LEVEL);
 #define AS5600_ANGLE_REGISTER_H 0x0E
 #define AS5600_FULL_ANGLE		360
 #define AS5600_PULSES_PER_REV	4096
+#define AS5600_MILLION_UNIT	1000000
 
 struct as5600_dev_cfg {
 	struct i2c_dt_spec i2c_port;
@@ -60,8 +61,8 @@ static int as5600_get(const struct device *dev, enum sensor_channel chan,
 		val->val1 = ((int32_t)dev_data->position * AS5600_FULL_ANGLE) /
 							AS5600_PULSES_PER_REV;
 
-		val->val2 = ((int32_t)dev_data->position * AS5600_FULL_ANGLE) -
-					(val->val1 * AS5600_PULSES_PER_REV);
+		val->val2 = (((int32_t)dev_data->position * AS5600_FULL_ANGLE) %
+			     AS5600_PULSES_PER_REV) * (AS5600_MILLION_UNIT / AS5600_PULSES_PER_REV);
 	} else {
 		return -ENOTSUP;
 	}

drivers/sensor/nxp_kinetis_temp/Kconfig

@@ -7,7 +7,8 @@ config TEMP_KINETIS
 	bool "NXP Kinetis Temperature Sensor"
 	default y
 	depends on DT_HAS_NXP_KINETIS_TEMPERATURE_ENABLED
-	depends on (ADC && SOC_FAMILY_KINETIS)
+	depends on SOC_FAMILY_KINETIS
+	select ADC
 	help
 	  Enable driver for NXP Kinetis temperature sensor.
 

drivers/sensor/nxp_kinetis_temp/temp_kinetis.c

@@ -159,7 +159,7 @@ static int temp_kinetis_init(const struct device *dev)
 		},
 	};
 
-	memset(&data->buffer, 0, ARRAY_SIZE(data->buffer));
+	memset(&data->buffer, 0, sizeof(data->buffer));
 
 	if (!device_is_ready(config->adc)) {
 		LOG_ERR("ADC device is not ready");

dts/arm/st/mp1/stm32mp157.dtsi

@@ -61,8 +61,8 @@
 			reg = <0x5000d000 0x400>;
 			num-lines = <16>;
 			interrupts = <6 0>, <7 0>, <8 0>, <9 0>,
-				     <10 0>, <23 0>, <40 0>, <42 0>,
-				     <64 0>, <65 0>, <66 0>, <67 0>,
+				     <10 0>, <23 0>, <64 0>, <65 0>,
+				     <66 0>, <67 0>, <40 0>, <42 0>,
 				     <76 0>, <77 0>, <121 0>, <127 0>;
 			interrupt-names = "line0", "line1", "line2", "line3",
 					  "line4", "line5", "line6", "line7",

dts/arm/st/wba/stm32wba.dtsi

@@ -33,7 +33,8 @@
 			device_type = "cpu";
 			compatible = "arm,cortex-m33";
 			reg = <0>;
-			cpu-power-states = <&stop0 &stop1 &standby>;
+			/* Do not add &standby here since CONFIG_PM_S2RAM is disabled by default */
+			cpu-power-states = <&stop0 &stop1>;
 			#address-cells = <1>;
 			#size-cells = <1>;
 

dts/bindings/can/can-fd-controller.yaml

@@ -47,6 +47,3 @@ properties:
     description: |
       Initial time quanta of phase buffer 2 segment for the data phase (ISO11898-1:2015). Deprecated
       in favor of setting advanced timing parameters from the application.
-  tx-delay-comp-offset:
-    type: int
-    default: 0

dts/riscv/ite/it82xx2.dtsi

@@ -275,7 +275,7 @@
 			       0x00f01639 1   /* GPOTR */
 			       0x00f01651 1   /* P18SCR */
 			       0x00f016a8 8>; /* GPCR */
-			ngpios = <6>;
+			ngpios = <8>;
 			gpio-controller;
 			interrupts = <IT8XXX2_IRQ_WU128 IRQ_TYPE_LEVEL_HIGH
 				      IT8XXX2_IRQ_WU129 IRQ_TYPE_LEVEL_HIGH
@@ -283,14 +283,14 @@
 				      IT8XXX2_IRQ_WU131 IRQ_TYPE_LEVEL_HIGH
 				      IT8XXX2_IRQ_WU132 IRQ_TYPE_LEVEL_HIGH
 				      IT8XXX2_IRQ_WU133 IRQ_TYPE_LEVEL_HIGH
-				      NO_FUNC 0
-				      NO_FUNC 0>;
+				      IT8XXX2_IRQ_WU134 IRQ_TYPE_LEVEL_HIGH
+				      IT8XXX2_IRQ_WU135 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-parent = <&intc>;
 			wuc-base = <0xf01b34 0xf01b34 0xf01b34 0xf01b34
-				    0xf01b34 0xf01b34 NO_FUNC  NO_FUNC >;
+				    0xf01b34 0xf01b34 0xf01b34  0xf01b34 >;
 			wuc-mask = <BIT(0)   BIT(1)   BIT(2)   BIT(3)
-				    BIT(4)   BIT(5)   0        0       >;
-			has-volt-sel = <1 1 1 1 1 1 0 0>;
+				    BIT(4)   BIT(5)   BIT(6)   BIT(7)>;
+			has-volt-sel = <1 1 1 1 1 1 1 1>;
 			#gpio-cells = <2>;
 		};
 
@@ -996,4 +996,3 @@
 		};
 	};
 };
-

include/zephyr/devicetree.h

@@ -2549,12 +2549,13 @@
 #define DT_IRQN_L1_INTERNAL(node_id, idx) DT_IRQ_BY_IDX(node_id, idx, irq)
 /* DT helper macro to encode a node's IRQN to level 2 according to the multi-level scheme */
 #define DT_IRQN_L2_INTERNAL(node_id, idx)                                                          \
-	(IRQ_TO_L2(DT_IRQN_L1_INTERNAL(node_id, idx)) | DT_IRQ(DT_IRQ_INTC(node_id), irq))
+	(IRQ_TO_L2(DT_IRQN_L1_INTERNAL(node_id, idx)) |                                            \
+	 DT_IRQ(DT_IRQ_INTC_BY_IDX(node_id, idx), irq))
 /* DT helper macro to encode a node's IRQN to level 3 according to the multi-level scheme */
 #define DT_IRQN_L3_INTERNAL(node_id, idx)                                                          \
 	(IRQ_TO_L3(DT_IRQN_L1_INTERNAL(node_id, idx)) |                                            \
-	 IRQ_TO_L2(DT_IRQ(DT_IRQ_INTC(node_id), irq)) |                                            \
-	 DT_IRQ(DT_IRQ_INTC(DT_IRQ_INTC(node_id)), irq))
+	 IRQ_TO_L2(DT_IRQ(DT_IRQ_INTC_BY_IDX(node_id, idx), irq)) |                                \
+	 DT_IRQ(DT_IRQ_INTC(DT_IRQ_INTC_BY_IDX(node_id, idx)), irq))
 /* DT helper macro for the macros above */
 #define DT_IRQN_LVL_INTERNAL(node_id, idx, level) DT_CAT3(DT_IRQN_L, level, _INTERNAL)(node_id, idx)
 

include/zephyr/drivers/bluetooth/hci_driver.h

@@ -89,8 +89,6 @@ static inline uint8_t bt_hci_evt_get_flags(uint8_t evt)
  * for so-called high priority HCI events, which should instead be delivered to
  * the host stack through bt_recv_prio().
  *
- * @note This function must only be called from a cooperative thread.
- *
  * @param buf Network buffer containing data from the controller.
  *
  * @return 0 on success or negative error number on failure.

include/zephyr/drivers/can.h

@@ -317,6 +317,23 @@ typedef void (*can_state_change_callback_t)(const struct device *dev,
  * For internal driver use only, skip these in public documentation.
  */
 
+/**
+ * @brief Calculate Transmitter Delay Compensation Offset from data phase timing parameters.
+ *
+ * Calculates the TDC Offset in minimum time quanta (mtq) using the sample point and CAN core clock
+ * prescaler specified by a set of data phase timing parameters.
+ *
+ * The result is clamped to the minimum/maximum supported TDC Offset values provided.
+ *
+ * @param _timing_data Pointer to data phase timing parameters.
+ * @param _tdco_min    Minimum supported TDC Offset value in mtq.
+ * @param _tdco_max    Maximum supported TDC Offset value in mtq.
+ * @return             Calculated TDC Offset value in mtq.
+ */
+#define CAN_CALC_TDCO(_timing_data, _tdco_min, _tdco_max)                                          \
+	CLAMP((1U + _timing_data->prop_seg + _timing_data->phase_seg1) * _timing_data->prescaler,  \
+	      _tdco_min, _tdco_max)
+
 /**
  * @brief Common CAN controller driver configuration.
  *

include/zephyr/drivers/can/can_mcan.h

@@ -1240,12 +1240,9 @@ struct can_mcan_config {
 	uint16_t sjw;
 	uint16_t prop_ts1;
 	uint16_t ts2;
-#ifdef CONFIG_CAN_FD_MODE
 	uint8_t sjw_data;
 	uint8_t prop_ts1_data;
 	uint8_t ts2_data;
-	uint8_t tx_delay_comp_offset;
-#endif
 	const void *custom;
 };
 
@@ -1313,7 +1310,6 @@ struct can_mcan_config {
 		.prop_ts1_data = DT_PROP_OR(node_id, prop_seg_data, 0) +                           \
 				 DT_PROP_OR(node_id, phase_seg1_data, 0),                          \
 		.ts2_data = DT_PROP_OR(node_id, phase_seg2_data, 0),                               \
-		.tx_delay_comp_offset = DT_PROP(node_id, tx_delay_comp_offset),                    \
 		.custom = _custom,                                                                 \
 	}
 #else /* CONFIG_CAN_FD_MODE */

include/zephyr/storage/stream_flash.h

@@ -141,7 +141,8 @@ int stream_flash_erase_page(struct stream_flash_ctx *ctx, off_t off);
  * @param settings_key key to use with the settings module for loading
  *                     the stream write progress
  *
- * @return non-negative on success, negative errno code on fail
+ * @return non-negative on success, -ERANGE in case when @p off is out
+ * of area designated for stream or negative errno code on fail
  */
 int stream_flash_progress_load(struct stream_flash_ctx *ctx,
 			       const char *settings_key);

kernel/dynamic.c

@@ -166,6 +166,15 @@ int z_impl_k_thread_stack_free(k_thread_stack_t *stack)
 #ifdef CONFIG_USERSPACE
 static inline int z_vrfy_k_thread_stack_free(k_thread_stack_t *stack)
 {
+	/* The thread stack object must not be in initialized state.
+	 *
+	 * Thread stack objects are initialized when the thread is created
+	 * and de-initialized whent the thread is destroyed. Since we can't
+	 * free a stack that is in use, we have to check that the caller
+	 * has access to the object but that it is not in use anymore.
+	 */
+	K_OOPS(K_SYSCALL_OBJ_NEVER_INIT(stack, K_OBJ_THREAD_STACK_ELEMENT));
+
 	return z_impl_k_thread_stack_free(stack);
 }
 #include <syscalls/k_thread_stack_free_mrsh.c>

kernel/sched.c

@@ -1653,13 +1653,18 @@ void z_impl_k_wakeup(k_tid_t thread)
 		}
 	}
 
+	k_spinlock_key_t  key = k_spin_lock(&sched_spinlock);
+
 	z_mark_thread_as_not_suspended(thread);
-	z_ready_thread(thread);
 
-	flag_ipi();
+	if (!thread_active_elsewhere(thread)) {
+		ready_thread(thread);
+	}
 
-	if (!arch_is_in_isr()) {
-		z_reschedule_unlocked();
+	if (arch_is_in_isr()) {
+		k_spin_unlock(&sched_spinlock, key);
+	} else {
+		z_reschedule(&sched_spinlock, key);
 	}
 }
 

lib/posix/options/eventfd.c

@@ -247,7 +247,9 @@ static int eventfd_ioctl_op(void *obj, unsigned int request, va_list args)
 			errno = EINVAL;
 			ret = -1;
 		} else {
-			efd->flags = flags;
+			int prev_flags = efd->flags & ~EFD_FLAGS_SET_INTERNAL;
+
+			efd->flags = flags | prev_flags;
 			ret = 0;
 		}
 	} break;

lib/utils/utf8.c

@@ -16,7 +16,14 @@
 
 char *utf8_trunc(char *utf8_str)
 {
-	char *last_byte_p = utf8_str + strlen(utf8_str) - 1;
+	const size_t len = strlen(utf8_str);
+
+	if (len == 0U) {
+		/* no-op */
+		return utf8_str;
+	}
+
+	char *last_byte_p = utf8_str + len - 1U;
 	uint8_t bytes_truncated;
 	char seq_start_byte;
 

samples/boards/stm32/power_mgmt/suspend_to_ram/boards/nucleo_wba55cg.overlay

@@ -7,6 +7,10 @@
 / {
 	/* Change min residency time to ease power consumption measurement */
 	cpus {
+		cpu0: cpu@0 {
+			cpu-power-states = <&stop0 &stop1 &standby>;
+		};
+
 		power-states {
 			stop0: state0 {
 				min-residency-us = <500000>;

samples/drivers/spi_flash/src/main.c

@@ -30,6 +30,8 @@
 #define SPI_FLASH_MULTI_SECTOR_TEST
 #endif
 
+const uint8_t erased[] = { 0xff, 0xff, 0xff, 0xff };
+
 void single_sector_test(const struct device *flash_dev)
 {
 	const uint8_t expected[] = { 0x55, 0xaa, 0x66, 0x99 };
@@ -53,9 +55,20 @@ void single_sector_test(const struct device *flash_dev)
 	if (rc != 0) {
 		printf("Flash erase failed! %d\n", rc);
 	} else {
+		/* Check erased pattern */
+		memset(buf, 0, len);
+		rc = flash_read(flash_dev, SPI_FLASH_TEST_REGION_OFFSET, buf, len);
+		if (rc != 0) {
+			printf("Flash read failed! %d\n", rc);
+			return;
+		}
+		if (memcmp(erased, buf, len) != 0) {
+			printf("Flash erase failed at offset 0x%x got 0x%x\n",
+				SPI_FLASH_TEST_REGION_OFFSET, *(uint32_t *)buf);
+			return;
+		}
 		printf("Flash erase succeeded!\n");
 	}
-
 	printf("\nTest 2: Flash write\n");
 
 	printf("Attempting to write %zu bytes\n", len);
@@ -98,7 +111,7 @@ void multi_sector_test(const struct device *flash_dev)
 	uint8_t buf[sizeof(expected)];
 	int rc;
 
-	printf("\nPerform test on multiple consequtive sectors");
+	printf("\nPerform test on multiple consecutive sectors");
 
 	/* Write protection needs to be disabled before each write or
 	 * erase, since the flash component turns on write protection
@@ -125,9 +138,9 @@ void multi_sector_test(const struct device *flash_dev)
 				printf("Flash read failed! %d\n", rc);
 				return;
 			}
-			if (buf[0] != 0xff) {
+			if (memcmp(erased, buf, len) != 0) {
 				printf("Flash erase failed at offset 0x%x got 0x%x\n",
-				offs, buf[0]);
+				offs, *(uint32_t *)buf);
 				return;
 			}
 			offs += SPI_FLASH_SECTOR_SIZE;

scripts/ci/twister_ignore.txt

@@ -23,6 +23,7 @@
 .github/workflows/stale-workflow-queue-cleanup.yml
 .github/workflows/greet_first_time_contributor.yml
 .github/workflows/issues-report-config.json
+.github/workflows/backport_issue_check.yml
 CODEOWNERS
 MAINTAINERS.yml
 LICENSE

scripts/snippets.py

@@ -56,7 +56,7 @@ class Snippet:
                 path = pathobj.parent / value
                 if not path.is_file():
                     _err(f'snippet file {pathobj}: {variable}: file not found: {path}')
-                return f'"{path}"'
+                return f'"{path.as_posix()}"'
             if variable in ('DTS_EXTRA_CPPFLAGS'):
                 return f'"{value}"'
             _err(f'unknown append variable: {variable}')

soc/arm/atmel_sam/same70/soc.c

@@ -122,6 +122,7 @@ void z_arm_platform_init(void)
 	 * sys_cache*-functions can enable them, if requested by the
 	 * configuration.
 	 */
+	SCB_InvalidateDCache();
 	SCB_DisableDCache();
 
 	/*

soc/arm/atmel_sam/samv71/soc.c

@@ -119,6 +119,7 @@ void z_arm_platform_init(void)
 	 * sys_cache*-functions can enable them, if requested by the
 	 * configuration.
 	 */
+	SCB_InvalidateDCache();
 	SCB_DisableDCache();
 
 	/*

soc/xtensa/intel_adsp/ace/power.c

@@ -176,6 +176,13 @@ void power_gate_entry(uint32_t core_id)
 	soc_cpus_active[core_id] = false;
 	sys_cache_data_flush_range(soc_cpus_active, sizeof(soc_cpus_active));
 	k_cpu_idle();
+
+	/* It is unlikely we get in here, but when this happens
+	 * we need to lock interruptions again.
+	 *
+	 * @note Zephyr looks PS.INTLEVEL to check if interruptions are locked.
+	 */
+	(void)arch_irq_lock();
 	z_xt_ints_off(0xffffffff);
 }
 

subsys/bluetooth/audio/ascs.c

@@ -42,6 +42,8 @@ LOG_MODULE_REGISTER(bt_ascs, CONFIG_BT_ASCS_LOG_LEVEL);
 				(CONFIG_BT_ASCS_ASE_SNK_COUNT + \
 				 CONFIG_BT_ASCS_ASE_SRC_COUNT)
 
+#define NTF_HEADER_SIZE (3) /* opcode (1) + handle (2) */
+
 BUILD_ASSERT(CONFIG_BT_ASCS_MAX_ACTIVE_ASES <= MAX(MAX_ASES_SESSIONS,
 						   CONFIG_BT_ISO_MAX_CHAN),
 	     "Max active ASEs are set to more than actual number of ASEs or ISOs");
@@ -84,8 +86,9 @@ static struct bt_ascs_ase {
  * writing
  */
 BUILD_ASSERT(
-	BT_ATT_BUF_SIZE - 3 >= ASE_BUF_SIZE ||
-		DIV_ROUND_UP(ASE_BUF_SIZE, (BT_ATT_BUF_SIZE - 3)) <= CONFIG_BT_ATT_PREPARE_COUNT,
+	(BT_ATT_BUF_SIZE - NTF_HEADER_SIZE) >= ASE_BUF_SIZE ||
+		DIV_ROUND_UP(ASE_BUF_SIZE, (BT_ATT_BUF_SIZE - NTF_HEADER_SIZE)) <=
+			CONFIG_BT_ATT_PREPARE_COUNT,
 	"CONFIG_BT_ATT_PREPARE_COUNT not large enough to cover the maximum supported ASCS value");
 
 /* It is mandatory to support long writes in ASCS unconditionally, and thus
@@ -174,9 +177,19 @@ static void ase_free(struct bt_ascs_ase *ase)
 	(void)k_work_cancel_delayable(&ase->state_transition_work);
 }
 
+static uint16_t get_max_ntf_size(struct bt_conn *conn)
+{
+	const uint16_t mtu = conn == NULL ? 0 : bt_gatt_get_mtu(conn);
+
+	if (mtu > NTF_HEADER_SIZE) {
+		return mtu - NTF_HEADER_SIZE;
+	}
+
+	return 0U;
+}
+
 static int ase_state_notify(struct bt_ascs_ase *ase)
 {
-	const uint8_t att_ntf_header_size = 3; /* opcode (1) + handle (2) */
 	struct bt_conn *conn = ase->conn;
 	struct bt_conn_info conn_info;
 	uint16_t max_ntf_size;
@@ -202,7 +215,7 @@ static int ase_state_notify(struct bt_ascs_ase *ase)
 
 	ascs_ep_get_status(&ase->ep, &ase_buf);
 
-	max_ntf_size = bt_gatt_get_mtu(conn) - att_ntf_header_size;
+	max_ntf_size = get_max_ntf_size(conn);
 
 	ntf_size = MIN(max_ntf_size, ase_buf.len);
 	if (ntf_size < ase_buf.len) {
@@ -1079,15 +1092,23 @@ static void ascs_ase_cfg_changed(const struct bt_gatt_attr *attr,
 	LOG_DBG("attr %p value 0x%04x", attr, value);
 }
 
-NET_BUF_SIMPLE_DEFINE_STATIC(rsp_buf, CONFIG_BT_L2CAP_TX_MTU);
+#define CP_RSP_BUF_SIZE                                                                            \
+	(sizeof(struct bt_ascs_cp_rsp) + (ASE_COUNT * sizeof(struct bt_ascs_cp_ase_rsp)))
+
+/* Ensure that the cp_rsp_buf can fit in any notification
+ * (sizeof buffer - header for notification)
+ */
+BUILD_ASSERT(BT_ATT_BUF_SIZE - NTF_HEADER_SIZE >= CP_RSP_BUF_SIZE,
+	     "BT_ATT_BUF_SIZE not large enough to hold responses for all ASEs");
+NET_BUF_SIMPLE_DEFINE_STATIC(cp_rsp_buf, CP_RSP_BUF_SIZE);
 
 static void ascs_cp_rsp_init(uint8_t op)
 {
 	struct bt_ascs_cp_rsp *rsp;
 
-	net_buf_simple_reset(&rsp_buf);
+	net_buf_simple_reset(&cp_rsp_buf);
 
-	rsp = net_buf_simple_add(&rsp_buf, sizeof(*rsp));
+	rsp = net_buf_simple_add(&cp_rsp_buf, sizeof(*rsp));
 	rsp->op = op;
 	rsp->num_ase = 0;
 }
@@ -1095,13 +1116,13 @@ static void ascs_cp_rsp_init(uint8_t op)
 /* Add response to an opcode/ASE ID */
 static void ascs_cp_rsp_add(uint8_t id, uint8_t code, uint8_t reason)
 {
-	struct bt_ascs_cp_rsp *rsp = (void *)rsp_buf.__buf;
+	struct bt_ascs_cp_rsp *rsp = (void *)cp_rsp_buf.__buf;
 	struct bt_ascs_cp_ase_rsp *ase_rsp;
 
 	LOG_DBG("id 0x%02x code %s (0x%02x) reason %s (0x%02x)", id,
 		bt_ascs_rsp_str(code), code, bt_ascs_reason_str(reason), reason);
 
-	if (rsp->num_ase == 0xff) {
+	if (rsp->num_ase == BT_ASCS_UNSUPP_OR_LENGTH_ERR_NUM_ASE) {
 		return;
 	}
 
@@ -1118,7 +1139,7 @@ static void ascs_cp_rsp_add(uint8_t id, uint8_t code, uint8_t reason)
 		break;
 	}
 
-	ase_rsp = net_buf_simple_add(&rsp_buf, sizeof(*ase_rsp));
+	ase_rsp = net_buf_simple_add(&cp_rsp_buf, sizeof(*ase_rsp));
 	ase_rsp->id = id;
 	ase_rsp->code = code;
 	ase_rsp->reason = reason;
@@ -1727,7 +1748,42 @@ int bt_ascs_config_ase(struct bt_conn *conn, struct bt_bap_stream *stream,
 	return 0;
 }
 
-static bool is_valid_config_len(struct net_buf_simple *buf)
+static uint16_t get_max_ase_rsp_for_conn(struct bt_conn *conn)
+{
+	const uint16_t max_ntf_size = get_max_ntf_size(conn);
+	const size_t rsp_hdr_size = sizeof(struct bt_ascs_cp_rsp);
+
+	if (max_ntf_size > rsp_hdr_size) {
+		return (max_ntf_size - rsp_hdr_size) / sizeof(struct bt_ascs_cp_ase_rsp);
+	}
+
+	return 0U;
+}
+
+static bool is_valid_num_ases(struct bt_conn *conn, uint8_t num_ases)
+{
+	const uint16_t max_ase_rsp = get_max_ase_rsp_for_conn(conn);
+
+	if (num_ases < 1U) {
+		LOG_WRN("Number_of_ASEs parameter value is less than 1");
+		return false;
+	} else if (num_ases > ASE_COUNT) {
+		/* If the request is for more ASEs than we have, we just reject the request */
+		LOG_DBG("Number_of_ASEs parameter value (%u) is greater than %d", num_ases,
+			ASE_COUNT);
+		return false;
+	} else if (num_ases > max_ase_rsp) {
+		/* If the request is for more ASEs than we can respond to, we reject the request */
+		LOG_DBG("Number_of_ASEs parameter value (%u) is greater than what we can respond "
+			"to (%u) based on the MTU",
+			num_ases, max_ase_rsp);
+		return false;
+	}
+
+	return true;
+}
+
+static bool is_valid_config_len(struct bt_conn *conn, struct net_buf_simple *buf)
 {
 	const struct bt_ascs_config_op *op;
 	struct net_buf_simple_state state;
@@ -1740,8 +1796,7 @@ static bool is_valid_config_len(struct net_buf_simple *buf)
 	}
 
 	op = net_buf_simple_pull_mem(buf, sizeof(*op));
-	if (op->num_ases < 1) {
-		LOG_WRN("Number_of_ASEs parameter value is less than 1");
+	if (!is_valid_num_ases(conn, op->num_ases)) {
 		return false;
 	}
 
@@ -1777,7 +1832,7 @@ static ssize_t ascs_config(struct bt_conn *conn, struct net_buf_simple *buf)
 	const struct bt_ascs_config_op *req;
 	const struct bt_ascs_config *cfg;
 
-	if (!is_valid_config_len(buf)) {
+	if (!is_valid_config_len(conn, buf)) {
 		return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN);
 	}
 
@@ -1945,7 +2000,7 @@ static void ase_qos(struct bt_ascs_ase *ase, uint8_t cig_id, uint8_t cis_id,
 	*rsp = BT_BAP_ASCS_RSP(BT_BAP_ASCS_RSP_CODE_SUCCESS, BT_BAP_ASCS_REASON_NONE);
 }
 
-static bool is_valid_qos_len(struct net_buf_simple *buf)
+static bool is_valid_qos_len(struct bt_conn *conn, struct net_buf_simple *buf)
 {
 	const struct bt_ascs_qos_op *op;
 	struct net_buf_simple_state state;
@@ -1959,8 +2014,7 @@ static bool is_valid_qos_len(struct net_buf_simple *buf)
 	}
 
 	op = net_buf_simple_pull_mem(buf, sizeof(*op));
-	if (op->num_ases < 1) {
-		LOG_WRN("Number_of_ASEs parameter value is less than 1");
+	if (!is_valid_num_ases(conn, op->num_ases)) {
 		return false;
 	}
 
@@ -1986,7 +2040,7 @@ static ssize_t ascs_qos(struct bt_conn *conn, struct net_buf_simple *buf)
 {
 	const struct bt_ascs_qos_op *req;
 
-	if (!is_valid_qos_len(buf)) {
+	if (!is_valid_qos_len(conn, buf)) {
 		return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN);
 	}
 
@@ -2327,7 +2381,7 @@ static int ase_enable(struct bt_ascs_ase *ase, struct bt_ascs_metadata *meta)
 	return 0;
 }
 
-static bool is_valid_enable_len(struct net_buf_simple *buf)
+static bool is_valid_enable_len(struct bt_conn *conn, struct net_buf_simple *buf)
 {
 	const struct bt_ascs_enable_op *op;
 	struct net_buf_simple_state state;
@@ -2340,8 +2394,7 @@ static bool is_valid_enable_len(struct net_buf_simple *buf)
 	}
 
 	op = net_buf_simple_pull_mem(buf, sizeof(*op));
-	if (op->num_ases < 1) {
-		LOG_WRN("Number_of_ASEs parameter value is less than 1");
+	if (!is_valid_num_ases(conn, op->num_ases)) {
 		return false;
 	}
 
@@ -2378,7 +2431,7 @@ static ssize_t ascs_enable(struct bt_conn *conn, struct net_buf_simple *buf)
 	struct bt_ascs_metadata *meta;
 	int i;
 
-	if (!is_valid_enable_len(buf)) {
+	if (!is_valid_enable_len(conn, buf)) {
 		return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN);
 	}
 
@@ -2472,7 +2525,7 @@ static void ase_start(struct bt_ascs_ase *ase)
 	ascs_cp_rsp_success(ASE_ID(ase));
 }
 
-static bool is_valid_start_len(struct net_buf_simple *buf)
+static bool is_valid_start_len(struct bt_conn *conn, struct net_buf_simple *buf)
 {
 	const struct bt_ascs_start_op *op;
 	struct net_buf_simple_state state;
@@ -2485,8 +2538,7 @@ static bool is_valid_start_len(struct net_buf_simple *buf)
 	}
 
 	op = net_buf_simple_pull_mem(buf, sizeof(*op));
-	if (op->num_ases < 1) {
-		LOG_WRN("Number_of_ASEs parameter value is less than 1");
+	if (!is_valid_num_ases(conn, op->num_ases)) {
 		return false;
 	}
 
@@ -2505,7 +2557,7 @@ static ssize_t ascs_start(struct bt_conn *conn, struct net_buf_simple *buf)
 	const struct bt_ascs_start_op *req;
 	int i;
 
-	if (!is_valid_start_len(buf)) {
+	if (!is_valid_start_len(conn, buf)) {
 		return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN);
 	}
 
@@ -2555,7 +2607,7 @@ static ssize_t ascs_start(struct bt_conn *conn, struct net_buf_simple *buf)
 	return buf->size;
 }
 
-static bool is_valid_disable_len(struct net_buf_simple *buf)
+static bool is_valid_disable_len(struct bt_conn *conn, struct net_buf_simple *buf)
 {
 	const struct bt_ascs_disable_op *op;
 	struct net_buf_simple_state state;
@@ -2568,8 +2620,7 @@ static bool is_valid_disable_len(struct net_buf_simple *buf)
 	}
 
 	op = net_buf_simple_pull_mem(buf, sizeof(*op));
-	if (op->num_ases < 1) {
-		LOG_WRN("Number_of_ASEs parameter value is less than 1");
+	if (!is_valid_num_ases(conn, op->num_ases)) {
 		return false;
 	}
 
@@ -2587,7 +2638,7 @@ static ssize_t ascs_disable(struct bt_conn *conn, struct net_buf_simple *buf)
 {
 	const struct bt_ascs_disable_op *req;
 
-	if (!is_valid_disable_len(buf)) {
+	if (!is_valid_disable_len(conn, buf)) {
 		return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN);
 	}
 
@@ -2685,7 +2736,7 @@ static void ase_stop(struct bt_ascs_ase *ase)
 	ascs_cp_rsp_success(ASE_ID(ase));
 }
 
-static bool is_valid_stop_len(struct net_buf_simple *buf)
+static bool is_valid_stop_len(struct bt_conn *conn, struct net_buf_simple *buf)
 {
 	const struct bt_ascs_stop_op *op;
 	struct net_buf_simple_state state;
@@ -2698,7 +2749,7 @@ static bool is_valid_stop_len(struct net_buf_simple *buf)
 	}
 
 	op = net_buf_simple_pull_mem(buf, sizeof(*op));
-	if (op->num_ases < 1) {
+	if (op->num_ases < 1U) {
 		LOG_WRN("Number_of_ASEs parameter value is less than 1");
 		return false;
 	}
@@ -2718,7 +2769,7 @@ static ssize_t ascs_stop(struct bt_conn *conn, struct net_buf_simple *buf)
 	const struct bt_ascs_start_op *req;
 	int i;
 
-	if (!is_valid_stop_len(buf)) {
+	if (!is_valid_stop_len(conn, buf)) {
 		return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN);
 	}
 
@@ -2768,7 +2819,7 @@ static ssize_t ascs_stop(struct bt_conn *conn, struct net_buf_simple *buf)
 	return buf->size;
 }
 
-static bool is_valid_metadata_len(struct net_buf_simple *buf)
+static bool is_valid_metadata_len(struct bt_conn *conn, struct net_buf_simple *buf)
 {
 	const struct bt_ascs_metadata_op *op;
 	struct net_buf_simple_state state;
@@ -2781,8 +2832,7 @@ static bool is_valid_metadata_len(struct net_buf_simple *buf)
 	}
 
 	op = net_buf_simple_pull_mem(buf, sizeof(*op));
-	if (op->num_ases < 1) {
-		LOG_WRN("Number_of_ASEs parameter value is less than 1");
+	if (!is_valid_num_ases(conn, op->num_ases)) {
 		return false;
 	}
 
@@ -2819,7 +2869,7 @@ static ssize_t ascs_metadata(struct bt_conn *conn, struct net_buf_simple *buf)
 	struct bt_ascs_metadata *meta;
 	int i;
 
-	if (!is_valid_metadata_len(buf)) {
+	if (!is_valid_metadata_len(conn, buf)) {
 		return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN);
 	}
 
@@ -2862,7 +2912,7 @@ static ssize_t ascs_metadata(struct bt_conn *conn, struct net_buf_simple *buf)
 	return buf->size;
 }
 
-static bool is_valid_release_len(struct net_buf_simple *buf)
+static bool is_valid_release_len(struct bt_conn *conn, struct net_buf_simple *buf)
 {
 	const struct bt_ascs_release_op *op;
 	struct net_buf_simple_state state;
@@ -2875,8 +2925,7 @@ static bool is_valid_release_len(struct net_buf_simple *buf)
 	}
 
 	op = net_buf_simple_pull_mem(buf, sizeof(*op));
-	if (op->num_ases < 1) {
-		LOG_WRN("Number_of_ASEs parameter value is less than 1");
+	if (!is_valid_num_ases(conn, op->num_ases)) {
 		return false;
 	}
 
@@ -2895,7 +2944,7 @@ static ssize_t ascs_release(struct bt_conn *conn, struct net_buf_simple *buf)
 	const struct bt_ascs_release_op *req;
 	int i;
 
-	if (!is_valid_release_len(buf)) {
+	if (!is_valid_release_len(conn, buf)) {
 		return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN);
 	}
 
@@ -3003,7 +3052,7 @@ static ssize_t ascs_cp_write(struct bt_conn *conn,
 	}
 
 respond:
-	control_point_notify(conn, rsp_buf.data, rsp_buf.len);
+	control_point_notify(conn, cp_rsp_buf.data, cp_rsp_buf.len);
 
 	return len;
 }

subsys/bluetooth/audio/bap_broadcast_assistant.c

@@ -23,6 +23,7 @@
 #include <zephyr/sys/check.h>
 
 #include <zephyr/logging/log.h>
+#include <sys/errno.h>
 
 LOG_MODULE_REGISTER(bt_bap_broadcast_assistant, CONFIG_BT_BAP_BROADCAST_ASSISTANT_LOG_LEVEL);
 
@@ -143,6 +144,13 @@ static int parse_recv_state(const void *data, uint16_t length,
 	}
 
 	recv_state->num_subgroups = net_buf_simple_pull_u8(&buf);
+	if (recv_state->num_subgroups > CONFIG_BT_BAP_BASS_MAX_SUBGROUPS) {
+		LOG_DBG("Cannot parse %u subgroups (max %d)", recv_state->num_subgroups,
+			CONFIG_BT_BAP_BASS_MAX_SUBGROUPS);
+
+		return -ENOMEM;
+	}
+
 	for (int i = 0; i < recv_state->num_subgroups; i++) {
 		struct bt_bap_bass_subgroup *subgroup = &recv_state->subgroups[i];
 		uint8_t *metadata;

subsys/bluetooth/controller/hci/hci.c

@@ -8516,7 +8516,7 @@ static void le_ltk_request(struct pdu_data *pdu_data, uint16_t handle,
 }
 
 static void encrypt_change(uint8_t err, uint16_t handle,
-			   struct net_buf *buf)
+			   struct net_buf *buf, bool encryption_on)
 {
 	struct bt_hci_evt_encrypt_change *ep;
 
@@ -8527,9 +8527,9 @@ static void encrypt_change(uint8_t err, uint16_t handle,
 	hci_evt_create(buf, BT_HCI_EVT_ENCRYPT_CHANGE, sizeof(*ep));
 	ep = net_buf_add(buf, sizeof(*ep));
 
-	ep->status = err;
+	ep->status = err ? err : (encryption_on ? err : BT_HCI_ERR_UNSPECIFIED);
 	ep->handle = sys_cpu_to_le16(handle);
-	ep->encrypt = !err ? 1 : 0;
+	ep->encrypt = encryption_on ? 1 : 0;
 }
 #endif /* CONFIG_BT_CTLR_LE_ENC */
 
@@ -8671,7 +8671,7 @@ static void encode_data_ctrl(struct node_rx_pdu *node_rx,
 		break;
 
 	case PDU_DATA_LLCTRL_TYPE_START_ENC_RSP:
-		encrypt_change(0x00, handle, buf);
+		encrypt_change(0x00, handle, buf, true);
 		break;
 #endif /* CONFIG_BT_CTLR_LE_ENC */
 
@@ -8688,7 +8688,7 @@ static void encode_data_ctrl(struct node_rx_pdu *node_rx,
 #if defined(CONFIG_BT_CTLR_LE_ENC)
 	case PDU_DATA_LLCTRL_TYPE_REJECT_IND:
 		encrypt_change(pdu_data->llctrl.reject_ind.error_code, handle,
-			       buf);
+			       buf, false);
 		break;
 #endif /* CONFIG_BT_CTLR_LE_ENC */
 

subsys/bluetooth/controller/ll_sw/ull.c

@@ -1954,12 +1954,15 @@ int ull_disable(void *lll)
 	if (!ull_ref_get(hdr)) {
 		return -EALREADY;
 	}
+	cpu_dmb(); /* Ensure synchronized data access */
 
 	k_sem_init(&sem, 0, 1);
 
 	hdr->disabled_param = &sem;
 	hdr->disabled_cb = disabled_cb;
 
+	cpu_dmb(); /* Ensure synchronized data access */
+
 	/* ULL_HIGH can run after we have call `ull_ref_get` and it can
 	 * decrement the ref count. Hence, handle this race condition by
 	 * ensuring that `disabled_cb` has been set while the ref count is still

subsys/bluetooth/controller/ll_sw/ull_llcp.c

@@ -284,11 +284,26 @@ void llcp_rx_node_retain(struct proc_ctx *ctx)
 {
 	LL_ASSERT(ctx->node_ref.rx);
 
-	/* Mark RX node to NOT release */
-	ctx->node_ref.rx->hdr.type = NODE_RX_TYPE_RETAIN;
+	/* Only retain if not already retained */
+	if (ctx->node_ref.rx->hdr.type != NODE_RX_TYPE_RETAIN) {
+		/* Mark RX node to NOT release */
+		ctx->node_ref.rx->hdr.type = NODE_RX_TYPE_RETAIN;
 
-	/* store link element reference to use once this node is moved up */
-	ctx->node_ref.rx->hdr.link = ctx->node_ref.link;
+		/* store link element reference to use once this node is moved up */
+		ctx->node_ref.rx->hdr.link = ctx->node_ref.link;
+	}
+}
+
+void llcp_rx_node_release(struct proc_ctx *ctx)
+{
+	LL_ASSERT(ctx->node_ref.rx);
+
+	/* Only release if retained */
+	if (ctx->node_ref.rx->hdr.type == NODE_RX_TYPE_RETAIN) {
+		/* Mark RX node to release and release */
+		ctx->node_ref.rx->hdr.type = NODE_RX_TYPE_RELEASE;
+		ll_rx_put_sched(ctx->node_ref.rx->hdr.link, ctx->node_ref.rx);
+	}
 }
 
 void llcp_nodes_release(struct ll_conn *conn, struct proc_ctx *ctx)
@@ -296,12 +311,14 @@ void llcp_nodes_release(struct ll_conn *conn, struct proc_ctx *ctx)
 	if (ctx->node_ref.rx && ctx->node_ref.rx->hdr.type == NODE_RX_TYPE_RETAIN) {
 		/* RX node retained, so release */
 		ctx->node_ref.rx->hdr.link->mem = conn->llcp.rx_node_release;
+		ctx->node_ref.rx->hdr.type = NODE_RX_TYPE_RELEASE;
 		conn->llcp.rx_node_release = ctx->node_ref.rx;
 	}
 #if defined(CONFIG_BT_CTLR_PHY) && defined(CONFIG_BT_CTLR_DATA_LENGTH)
 	if (ctx->proc == PROC_PHY_UPDATE && ctx->data.pu.ntf_dle_node) {
 		/* RX node retained, so release */
 		ctx->data.pu.ntf_dle_node->hdr.link->mem = conn->llcp.rx_node_release;
+		ctx->data.pu.ntf_dle_node->hdr.type = NODE_RX_TYPE_RELEASE;
 		conn->llcp.rx_node_release = ctx->data.pu.ntf_dle_node;
 	}
 #endif
@@ -706,9 +723,6 @@ void ull_cp_release_nodes(struct ll_conn *conn)
 		hdr = &rx->hdr;
 		rx = hdr->link->mem;
 
-		/* Mark for buffer for release */
-		hdr->type = NODE_RX_TYPE_RELEASE;
-
 		/* enqueue rx node towards Thread */
 		ll_rx_put(hdr->link, hdr);
 	}

subsys/bluetooth/controller/ll_sw/ull_llcp_common.c

@@ -1139,6 +1139,7 @@ static void rp_comm_ntf(struct ll_conn *conn, struct proc_ctx *ctx, uint8_t gene
 
 	/* Allocate ntf node */
 	ntf = ctx->node_ref.rx;
+	ctx->node_ref.rx = NULL;
 	LL_ASSERT(ntf);
 
 	/* This should be an 'old' RX node, so put/sched when done */

subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c

@@ -196,6 +196,22 @@ static bool cu_check_conn_parameters(struct ll_conn *conn, struct proc_ctx *ctx)
 }
 #endif /* CONFIG_BT_CTLR_CONN_PARAM_REQ */
 
+static bool cu_check_conn_ind_parameters(struct ll_conn *conn, struct proc_ctx *ctx)
+{
+	const uint16_t interval_max = ctx->data.cu.interval_max; /* unit 1.25ms */
+	const uint16_t timeout = ctx->data.cu.timeout; /* unit 10ms */
+	const uint16_t latency = ctx->data.cu.latency;
+
+	/* Valid conn_update_ind parameters */
+	return (interval_max >= CONN_INTERVAL_MIN(conn)) &&
+	       (interval_max <= CONN_UPDATE_CONN_INTV_4SEC) &&
+	       (latency <= CONN_UPDATE_LATENCY_MAX) &&
+	       (timeout >= CONN_UPDATE_TIMEOUT_100MS) &&
+	       (timeout <= CONN_UPDATE_TIMEOUT_32SEC) &&
+	       ((timeout * 4U) > /* *4U re. conn events is equivalent to *2U re. ms */
+		((latency + 1U) * interval_max));
+}
+
 static void cu_prepare_update_ind(struct ll_conn *conn, struct proc_ctx *ctx)
 {
 	ctx->data.cu.win_size = 1U;
@@ -585,8 +601,20 @@ static void lp_cu_st_wait_rx_conn_update_ind(struct ll_conn *conn, struct proc_c
 	switch (evt) {
 	case LP_CU_EVT_CONN_UPDATE_IND:
 		llcp_pdu_decode_conn_update_ind(ctx, param);
+
+		/* Invalid PDU, mark the connection for termination */
+		if (!cu_check_conn_ind_parameters(conn, ctx)) {
+			llcp_rr_set_incompat(conn, INCOMPAT_NO_COLLISION);
+			conn->llcp_terminate.reason_final = BT_HCI_ERR_INVALID_LL_PARAM;
+			lp_cu_complete(conn, ctx);
+			break;
+		}
+
+		llcp_rr_set_incompat(conn, INCOMPAT_RESERVED);
+
 		/* Keep RX node to use for NTF */
 		llcp_rx_node_retain(ctx);
+
 		ctx->state = LP_CU_STATE_WAIT_INSTANT;
 		break;
 	case LP_CU_EVT_UNKNOWN:
@@ -633,8 +661,7 @@ static void lp_cu_check_instant(struct ll_conn *conn, struct proc_ctx *ctx, uint
 			lp_cu_ntf_complete(conn, ctx, evt, param);
 		} else {
 			/* Release RX node kept for NTF */
-			ctx->node_ref.rx->hdr.type = NODE_RX_TYPE_RELEASE;
-			ll_rx_put_sched(ctx->node_ref.rx->hdr.link, ctx->node_ref.rx);
+			llcp_rx_node_release(ctx);
 			ctx->node_ref.rx = NULL;
 
 			lp_cu_complete(conn, ctx);
@@ -973,11 +1000,18 @@ static void rp_cu_st_wait_conn_param_req_available(struct ll_conn *conn, struct
 	case RP_CU_EVT_RUN:
 		if (cpr_active_is_set(conn)) {
 			ctx->state = RP_CU_STATE_WAIT_CONN_PARAM_REQ_AVAILABLE;
+
 			if (!llcp_rr_ispaused(conn) && llcp_tx_alloc_peek(conn, ctx)) {
 				/* We're good to reject immediately */
 				ctx->data.cu.rejected_opcode = PDU_DATA_LLCTRL_TYPE_CONN_PARAM_REQ;
 				ctx->data.cu.error = BT_HCI_ERR_UNSUPP_LL_PARAM_VAL;
 				rp_cu_send_reject_ext_ind(conn, ctx, evt, param);
+
+				/* Possibly retained rx node to be released as we won't need it */
+				llcp_rx_node_release(ctx);
+				ctx->node_ref.rx = NULL;
+
+				break;
 			}
 			/* In case we have to defer NTF */
 			llcp_rx_node_retain(ctx);
@@ -992,6 +1026,9 @@ static void rp_cu_st_wait_conn_param_req_available(struct ll_conn *conn, struct
 				rp_cu_conn_param_req_ntf(conn, ctx);
 				ctx->state = RP_CU_STATE_WAIT_CONN_PARAM_REQ_REPLY;
 			} else {
+				/* Possibly retained rx node to be released as we won't need it */
+				llcp_rx_node_release(ctx);
+				ctx->node_ref.rx = NULL;
 #if defined(CONFIG_BT_CTLR_USER_CPR_ANCHOR_POINT_MOVE)
 				/* Handle APM as a vendor specific user extension */
 				if (conn->lll.role == BT_HCI_ROLE_PERIPHERAL &&
@@ -1177,8 +1214,7 @@ static void rp_cu_check_instant(struct ll_conn *conn, struct proc_ctx *ctx, uint
 			cu_ntf(conn, ctx);
 		} else {
 			/* Release RX node kept for NTF */
-			ctx->node_ref.rx->hdr.type = NODE_RX_TYPE_RELEASE;
-			ll_rx_put_sched(ctx->node_ref.rx->hdr.link, ctx->node_ref.rx);
+			llcp_rx_node_release(ctx);
 			ctx->node_ref.rx = NULL;
 		}
 		rp_cu_complete(conn, ctx);
@@ -1198,19 +1234,27 @@ static void rp_cu_st_wait_rx_conn_update_ind(struct ll_conn *conn, struct proc_c
 		case BT_HCI_ROLE_PERIPHERAL:
 			llcp_pdu_decode_conn_update_ind(ctx, param);
 
-			if (is_instant_not_passed(ctx->data.cu.instant,
-						  ull_conn_event_counter(conn))) {
+			/* Valid PDU */
+			if (cu_check_conn_ind_parameters(conn, ctx)) {
+				if (is_instant_not_passed(ctx->data.cu.instant,
+							  ull_conn_event_counter(conn))) {
+					/* Keep RX node to use for NTF */
+					llcp_rx_node_retain(ctx);
 
-				llcp_rx_node_retain(ctx);
+					ctx->state = RP_CU_STATE_WAIT_INSTANT;
+
+					/* In case we only just received it in time */
+					rp_cu_check_instant(conn, ctx, evt, param);
+					break;
+				}
 
-				ctx->state = RP_CU_STATE_WAIT_INSTANT;
-				/* In case we only just received it in time */
-				rp_cu_check_instant(conn, ctx, evt, param);
-			} else {
 				conn->llcp_terminate.reason_final = BT_HCI_ERR_INSTANT_PASSED;
-				llcp_rr_complete(conn);
-				ctx->state = RP_CU_STATE_IDLE;
+			} else {
+				conn->llcp_terminate.reason_final = BT_HCI_ERR_INVALID_LL_PARAM;
 			}
+
+			llcp_rr_complete(conn);
+			ctx->state = RP_CU_STATE_IDLE;
 			break;
 		default:
 			/* Unknown role */

subsys/bluetooth/controller/ll_sw/ull_llcp_enc.c

@@ -225,6 +225,7 @@ static void lp_enc_ntf(struct ll_conn *conn, struct proc_ctx *ctx)
 
 	/* Piggy-back on RX node */
 	ntf = ctx->node_ref.rx;
+	ctx->node_ref.rx = NULL;
 	LL_ASSERT(ntf);
 
 	ntf->hdr.type = NODE_RX_TYPE_DC_PDU;
@@ -381,19 +382,29 @@ static void lp_enc_store_s(struct ll_conn *conn, struct proc_ctx *ctx, struct pd
 
 static inline uint8_t reject_error_code(struct pdu_data *pdu)
 {
+	uint8_t error;
+
 	if (pdu->llctrl.opcode == PDU_DATA_LLCTRL_TYPE_REJECT_IND) {
-		return pdu->llctrl.reject_ind.error_code;
+		error = pdu->llctrl.reject_ind.error_code;
 #if defined(CONFIG_BT_CTLR_EXT_REJ_IND)
 	} else if (pdu->llctrl.opcode == PDU_DATA_LLCTRL_TYPE_REJECT_EXT_IND) {
-		return pdu->llctrl.reject_ext_ind.error_code;
+		error = pdu->llctrl.reject_ext_ind.error_code;
 #endif /* CONFIG_BT_CTLR_EXT_REJ_IND */
 	} else {
 		/* Called with an invalid PDU */
 		LL_ASSERT(0);
 
 		/* Keep compiler happy */
-		return BT_HCI_ERR_UNSPECIFIED;
+		error = BT_HCI_ERR_UNSPECIFIED;
 	}
+
+	/* Check expected error code from the peer */
+	if (error != BT_HCI_ERR_PIN_OR_KEY_MISSING &&
+	    error != BT_HCI_ERR_UNSUPP_REMOTE_FEATURE) {
+		error = BT_HCI_ERR_UNSPECIFIED;
+	}
+
+	return error;
 }
 
 static void lp_enc_st_wait_rx_enc_rsp(struct ll_conn *conn, struct proc_ctx *ctx, uint8_t evt,

subsys/bluetooth/controller/ll_sw/ull_llcp_internal.h

@@ -413,6 +413,7 @@ void llcp_ntf_set_pending(struct ll_conn *conn);
 void llcp_ntf_clear_pending(struct ll_conn *conn);
 bool llcp_ntf_pending(struct ll_conn *conn);
 void llcp_rx_node_retain(struct proc_ctx *ctx);
+void llcp_rx_node_release(struct proc_ctx *ctx);
 
 /*
  * ULL -> LLL Interface

subsys/bluetooth/controller/ll_sw/ull_llcp_local.c

@@ -81,6 +81,12 @@ void llcp_lr_check_done(struct ll_conn *conn, struct proc_ctx *ctx)
 		ctx_header = llcp_lr_peek(conn);
 		LL_ASSERT(ctx_header == ctx);
 
+		/* If we have a node rx it must not be marked RETAIN as
+		 * the memory referenced would leak
+		 */
+		LL_ASSERT(ctx->node_ref.rx == NULL ||
+			  ctx->node_ref.rx->hdr.type != NODE_RX_TYPE_RETAIN);
+
 		lr_dequeue(conn);
 
 		llcp_proc_ctx_release(ctx);
@@ -312,6 +318,11 @@ void llcp_lr_rx(struct ll_conn *conn, struct proc_ctx *ctx, memq_link_t *link,
 		break;
 	}
 
+	/* If rx node was not retained clear reference */
+	if (ctx->node_ref.rx && ctx->node_ref.rx->hdr.type != NODE_RX_TYPE_RETAIN) {
+		ctx->node_ref.rx = NULL;
+	}
+
 	llcp_lr_check_done(conn, ctx);
 }
 

subsys/bluetooth/controller/ll_sw/ull_llcp_phy.c

@@ -433,6 +433,7 @@ static void pu_ntf(struct ll_conn *conn, struct proc_ctx *ctx)
 
 	/* Piggy-back on stored RX node */
 	ntf = ctx->node_ref.rx;
+	ctx->node_ref.rx = NULL;
 	LL_ASSERT(ntf);
 
 	if (ctx->data.pu.ntf_pu) {
@@ -449,15 +450,9 @@ static void pu_ntf(struct ll_conn *conn, struct proc_ctx *ctx)
 	}
 
 	/* Enqueue notification towards LL */
-#if defined(CONFIG_BT_CTLR_DATA_LENGTH)
-	/* only 'put' as the 'sched' is handled when handling DLE ntf */
-	ll_rx_put(ntf->hdr.link, ntf);
-#else
 	ll_rx_put_sched(ntf->hdr.link, ntf);
-#endif /* CONFIG_BT_CTLR_DATA_LENGTH */
 
 	ctx->data.pu.ntf_pu = 0;
-	ctx->node_ref.rx = NULL;
 }
 
 #if defined(CONFIG_BT_CTLR_DATA_LENGTH)

subsys/bluetooth/controller/ll_sw/ull_llcp_remote.c

@@ -118,6 +118,12 @@ void llcp_rr_check_done(struct ll_conn *conn, struct proc_ctx *ctx)
 		ctx_header = llcp_rr_peek(conn);
 		LL_ASSERT(ctx_header == ctx);
 
+		/* If we have a node rx it must not be marked RETAIN as
+		 * the memory referenced would leak
+		 */
+		LL_ASSERT(ctx->node_ref.rx == NULL ||
+			  ctx->node_ref.rx->hdr.type != NODE_RX_TYPE_RETAIN);
+
 		rr_dequeue(conn);
 
 		llcp_proc_ctx_release(ctx);
@@ -307,6 +313,12 @@ void llcp_rr_rx(struct ll_conn *conn, struct proc_ctx *ctx, memq_link_t *link,
 		LL_ASSERT(0);
 		break;
 	}
+
+	/* If rx node was not retained clear reference */
+	if (ctx->node_ref.rx && ctx->node_ref.rx->hdr.type != NODE_RX_TYPE_RETAIN) {
+		ctx->node_ref.rx = NULL;
+	}
+
 	llcp_rr_check_done(conn, ctx);
 }
 

subsys/bluetooth/host/gatt.c

@@ -3910,7 +3910,7 @@ static uint16_t parse_include(struct bt_conn *conn, const void *pdu,
 			   struct bt_gatt_discover_params *params,
 			   uint16_t length)
 {
-	const struct bt_att_read_type_rsp *rsp = pdu;
+	const struct bt_att_read_type_rsp *rsp;
 	uint16_t handle = 0U;
 	struct bt_gatt_include value;
 	union {
@@ -3919,6 +3919,13 @@ static uint16_t parse_include(struct bt_conn *conn, const void *pdu,
 		struct bt_uuid_128 u128;
 	} u;
 
+	if (length < sizeof(*rsp)) {
+		LOG_WRN("Parse err");
+		goto done;
+	}
+
+	rsp = pdu;
+
 	/* Data can be either in UUID16 or UUID128 */
 	switch (rsp->len) {
 	case 8: /* UUID16 */
@@ -4003,7 +4010,7 @@ static uint16_t parse_characteristic(struct bt_conn *conn, const void *pdu,
 				  struct bt_gatt_discover_params *params,
 				  uint16_t length)
 {
-	const struct bt_att_read_type_rsp *rsp = pdu;
+	const struct bt_att_read_type_rsp *rsp;
 	uint16_t handle = 0U;
 	union {
 		struct bt_uuid uuid;
@@ -4011,6 +4018,13 @@ static uint16_t parse_characteristic(struct bt_conn *conn, const void *pdu,
 		struct bt_uuid_128 u128;
 	} u;
 
+	if (length < sizeof(*rsp)) {
+		LOG_WRN("Parse err");
+		goto done;
+	}
+
+	rsp = pdu;
+
 	/* Data can be either in UUID16 or UUID128 */
 	switch (rsp->len) {
 	case 7: /* UUID16 */
@@ -4084,7 +4098,7 @@ static uint16_t parse_read_std_char_desc(struct bt_conn *conn, const void *pdu,
 					 struct bt_gatt_discover_params *params,
 					 uint16_t length)
 {
-	const struct bt_att_read_type_rsp *rsp = pdu;
+	const struct bt_att_read_type_rsp *rsp;
 	uint16_t handle = 0U;
 	uint16_t uuid_val;
 
@@ -4094,6 +4108,13 @@ static uint16_t parse_read_std_char_desc(struct bt_conn *conn, const void *pdu,
 
 	uuid_val = BT_UUID_16(params->uuid)->val;
 
+	if (length < sizeof(*rsp)) {
+		LOG_WRN("Parse err");
+		goto done;
+	}
+
+	rsp = pdu;
+
 	/* Parse characteristics found */
 	for (length--, pdu = rsp->data; length >= rsp->len;
 	     length -= rsp->len, pdu = (const uint8_t *)pdu + rsp->len) {
@@ -4103,9 +4124,16 @@ static uint16_t parse_read_std_char_desc(struct bt_conn *conn, const void *pdu,
 			struct bt_gatt_cep cep;
 			struct bt_gatt_scc scc;
 		} value;
-		const struct bt_att_data *data = pdu;
+		const struct bt_att_data *data;
 		struct bt_gatt_attr attr;
 
+		if (length < sizeof(*data)) {
+			LOG_WRN("Parse err dat");
+			goto done;
+		}
+
+		data = pdu;
+
 		handle = sys_le16_to_cpu(data->handle);
 		/* Handle 0 is invalid */
 		if (!handle) {
@@ -4114,17 +4142,39 @@ static uint16_t parse_read_std_char_desc(struct bt_conn *conn, const void *pdu,
 
 		switch (uuid_val) {
 		case BT_UUID_GATT_CEP_VAL:
+			if (length < sizeof(*data) + sizeof(uint16_t)) {
+				LOG_WRN("Parse err cep");
+				goto done;
+			}
+
 			value.cep.properties = sys_get_le16(data->value);
 			break;
 		case BT_UUID_GATT_CCC_VAL:
+			if (length < sizeof(*data) + sizeof(uint16_t)) {
+				LOG_WRN("Parse err ccc");
+				goto done;
+			}
+
 			value.ccc.flags = sys_get_le16(data->value);
 			break;
 		case BT_UUID_GATT_SCC_VAL:
+			if (length < sizeof(*data) + sizeof(uint16_t)) {
+				LOG_WRN("Parse err scc");
+				goto done;
+			}
+
 			value.scc.flags = sys_get_le16(data->value);
 			break;
 		case BT_UUID_GATT_CPF_VAL:
 		{
-			struct gatt_cpf *cpf = (struct gatt_cpf *)data->value;
+			struct gatt_cpf *cpf;
+
+			if (length < sizeof(*data) + sizeof(*cpf)) {
+				LOG_WRN("Parse err cpf");
+				goto done;
+			}
+
+			cpf = (void *)data->value;
 
 			value.cpf.format = cpf->format;
 			value.cpf.exponent = cpf->exponent;
@@ -4227,7 +4277,7 @@ static uint16_t parse_service(struct bt_conn *conn, const void *pdu,
 				  struct bt_gatt_discover_params *params,
 				  uint16_t length)
 {
-	const struct bt_att_read_group_rsp *rsp = pdu;
+	const struct bt_att_read_group_rsp *rsp;
 	uint16_t start_handle, end_handle = 0U;
 	union {
 		struct bt_uuid uuid;
@@ -4235,6 +4285,13 @@ static uint16_t parse_service(struct bt_conn *conn, const void *pdu,
 		struct bt_uuid_128 u128;
 	} u;
 
+	if (length < sizeof(*rsp)) {
+		LOG_WRN("Parse err");
+		goto done;
+	}
+
+	rsp = pdu;
+
 	/* Data can be either in UUID16 or UUID128 */
 	switch (rsp->len) {
 	case 6: /* UUID16 */
@@ -4365,7 +4422,7 @@ static void gatt_find_info_rsp(struct bt_conn *conn, int err,
 			       const void *pdu, uint16_t length,
 			       void *user_data)
 {
-	const struct bt_att_find_info_rsp *rsp = pdu;
+	const struct bt_att_find_info_rsp *rsp;
 	struct bt_gatt_discover_params *params = user_data;
 	uint16_t handle = 0U;
 	uint16_t len;
@@ -4387,6 +4444,13 @@ static void gatt_find_info_rsp(struct bt_conn *conn, int err,
 		goto done;
 	}
 
+	if (length < sizeof(*rsp)) {
+		LOG_WRN("Parse err");
+		goto done;
+	}
+
+	rsp = pdu;
+
 	/* Data can be either in UUID16 or UUID128 */
 	switch (rsp->format) {
 	case BT_ATT_INFO_16:
@@ -4992,7 +5056,7 @@ static void gatt_prepare_write_rsp(struct bt_conn *conn, int err,
 				   void *user_data)
 {
 	struct bt_gatt_write_params *params = user_data;
-	const struct bt_att_prepare_write_rsp *rsp = pdu;
+	const struct bt_att_prepare_write_rsp *rsp;
 	size_t len;
 	bool data_valid;
 
@@ -5004,6 +5068,13 @@ static void gatt_prepare_write_rsp(struct bt_conn *conn, int err,
 		return;
 	}
 
+	if (length < sizeof(*rsp)) {
+		LOG_WRN("Parse err");
+		goto fail;
+	}
+
+	rsp = pdu;
+
 	len = length - sizeof(*rsp);
 	if (len > params->length) {
 		LOG_ERR("Incorrect length, canceling write");

subsys/bluetooth/host/hci_core.c

@@ -2062,6 +2062,12 @@ static void hci_encrypt_change(struct net_buf *buf)
 		return;
 	}
 
+	if (conn->encrypt == evt->encrypt) {
+		LOG_WRN("No change to encryption state (encrypt 0x%02x)", evt->encrypt);
+		bt_conn_unref(conn);
+		return;
+	}
+
 	conn->encrypt = evt->encrypt;
 
 #if defined(CONFIG_BT_SMP)
@@ -3848,7 +3854,7 @@ static void rx_queue_put(struct net_buf *buf)
 }
 #endif /* !CONFIG_BT_RECV_BLOCKING */
 
-int bt_recv(struct net_buf *buf)
+static int bt_recv_unsafe(struct net_buf *buf)
 {
 	bt_monitor_send(bt_monitor_opcode(buf), buf->data, buf->len);
 
@@ -3899,6 +3905,17 @@ int bt_recv(struct net_buf *buf)
 	}
 }
 
+int bt_recv(struct net_buf *buf)
+{
+	int err;
+
+	k_sched_lock();
+	err = bt_recv_unsafe(buf);
+	k_sched_unlock();
+
+	return err;
+}
+
 int bt_recv_prio(struct net_buf *buf)
 {
 	bt_monitor_send(bt_monitor_opcode(buf), buf->data, buf->len);

subsys/bluetooth/host/l2cap_br.c

@@ -392,6 +392,11 @@ static int l2cap_br_info_rsp(struct bt_l2cap_br *l2cap, uint8_t ident,
 
 	switch (type) {
 	case BT_L2CAP_INFO_FEAT_MASK:
+		if (buf->len < sizeof(uint32_t)) {
+			LOG_ERR("Invalid remote info feat mask");
+			err = -EINVAL;
+			break;
+		}
 		l2cap->info_feat_mask = net_buf_pull_le32(buf);
 		LOG_DBG("remote info mask 0x%08x", l2cap->info_feat_mask);
 
@@ -402,6 +407,11 @@ static int l2cap_br_info_rsp(struct bt_l2cap_br *l2cap, uint8_t ident,
 		l2cap_br_get_info(l2cap, BT_L2CAP_INFO_FIXED_CHAN);
 		return 0;
 	case BT_L2CAP_INFO_FIXED_CHAN:
+		if (buf->len < sizeof(uint8_t)) {
+			LOG_ERR("Invalid remote info fixed chan");
+			err = -EINVAL;
+			break;
+		}
 		l2cap->info_fixed_chan = net_buf_pull_u8(buf);
 		LOG_DBG("remote fixed channel mask 0x%02x", l2cap->info_fixed_chan);
 

subsys/bluetooth/host/rfcomm.c

@@ -1454,10 +1454,13 @@ static int rfcomm_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
 {
 	struct bt_rfcomm_session *session = RFCOMM_SESSION(chan);
 	struct bt_rfcomm_hdr *hdr = (void *)buf->data;
+	struct bt_rfcomm_hdr_ext *hdr_ext = (void *)buf->data;
 	uint8_t dlci, frame_type, fcs, fcs_len;
+	uint16_t msg_len;
+	uint16_t hdr_len;
 
 	/* Need to consider FCS also*/
-	if (buf->len < (sizeof(*hdr) + 1)) {
+	if (buf->len < (sizeof(*hdr) + sizeof(fcs))) {
 		LOG_ERR("Too small RFCOMM Frame");
 		return 0;
 	}
@@ -1467,19 +1470,28 @@ static int rfcomm_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
 
 	LOG_DBG("session %p dlci %x type %x", session, dlci, frame_type);
 
-	fcs_len = (frame_type == BT_RFCOMM_UIH) ? BT_RFCOMM_FCS_LEN_UIH :
-		   BT_RFCOMM_FCS_LEN_NON_UIH;
-	fcs = *(net_buf_tail(buf) - 1);
+	if (BT_RFCOMM_LEN_EXTENDED(hdr->length)) {
+		msg_len = BT_RFCOMM_GET_LEN_EXTENDED(hdr_ext->hdr.length, hdr_ext->second_length);
+		hdr_len = sizeof(*hdr_ext);
+	} else {
+		msg_len = BT_RFCOMM_GET_LEN(hdr->length);
+		hdr_len = sizeof(*hdr);
+	}
+
+	if (buf->len < (hdr_len + msg_len + sizeof(fcs))) {
+		LOG_ERR("Too small RFCOMM information (%d < %d)", buf->len,
+			hdr_len + msg_len + sizeof(fcs));
+		return 0;
+	}
+
+	fcs_len = (frame_type == BT_RFCOMM_UIH) ? BT_RFCOMM_FCS_LEN_UIH : hdr_len;
+	fcs = *(net_buf_tail(buf) - sizeof(fcs));
 	if (!rfcomm_check_fcs(fcs_len, buf->data, fcs)) {
 		LOG_ERR("FCS check failed");
 		return 0;
 	}
 
-	if (BT_RFCOMM_LEN_EXTENDED(hdr->length)) {
-		net_buf_pull(buf, sizeof(*hdr) + 1);
-	} else {
-		net_buf_pull(buf, sizeof(*hdr));
-	}
+	net_buf_pull(buf, hdr_len);
 
 	switch (frame_type) {
 	case BT_RFCOMM_SABM:
@@ -1489,8 +1501,7 @@ static int rfcomm_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
 		if (!dlci) {
 			rfcomm_handle_msg(session, buf);
 		} else {
-			rfcomm_handle_data(session, buf, dlci,
-					   BT_RFCOMM_GET_PF(hdr->control));
+			rfcomm_handle_data(session, buf, dlci, BT_RFCOMM_GET_PF(hdr->control));
 		}
 		break;
 	case BT_RFCOMM_DISC:

subsys/bluetooth/host/rfcomm_internal.h

@@ -49,6 +49,11 @@ struct bt_rfcomm_hdr {
 	uint8_t length;
 } __packed;
 
+struct bt_rfcomm_hdr_ext {
+	struct bt_rfcomm_hdr hdr;
+	uint8_t second_length;
+} __packed;
+
 #define BT_RFCOMM_SABM  0x2f
 #define BT_RFCOMM_UA    0x63
 #define BT_RFCOMM_UIH   0xef
@@ -137,13 +142,14 @@ struct bt_rfcomm_rpn {
 				 sizeof(struct bt_rfcomm_hdr) + 1 + (mtu) + \
 				 BT_RFCOMM_FCS_SIZE)
 
-#define BT_RFCOMM_GET_DLCI(addr)           (((addr) & 0xfc) >> 2)
-#define BT_RFCOMM_GET_FRAME_TYPE(ctrl)     ((ctrl) & 0xef)
-#define BT_RFCOMM_GET_MSG_TYPE(type)       (((type) & 0xfc) >> 2)
-#define BT_RFCOMM_GET_MSG_CR(type)         (((type) & 0x02) >> 1)
-#define BT_RFCOMM_GET_LEN(len)             (((len) & 0xfe) >> 1)
-#define BT_RFCOMM_GET_CHANNEL(dlci)        ((dlci) >> 1)
-#define BT_RFCOMM_GET_PF(ctrl)             (((ctrl) & 0x10) >> 4)
+#define BT_RFCOMM_GET_DLCI(addr)                  (((addr) & 0xfc) >> 2)
+#define BT_RFCOMM_GET_FRAME_TYPE(ctrl)            ((ctrl) & 0xef)
+#define BT_RFCOMM_GET_MSG_TYPE(type)              (((type) & 0xfc) >> 2)
+#define BT_RFCOMM_GET_MSG_CR(type)                (((type) & 0x02) >> 1)
+#define BT_RFCOMM_GET_LEN(len)                    (((len) & 0xfe) >> 1)
+#define BT_RFCOMM_GET_LEN_EXTENDED(first, second) ((((first) & 0xfe) >> 1) | ((second) << 7))
+#define BT_RFCOMM_GET_CHANNEL(dlci)               ((dlci) >> 1)
+#define BT_RFCOMM_GET_PF(ctrl)                    (((ctrl) & 0x10) >> 4)
 
 #define BT_RFCOMM_SET_ADDR(dlci, cr)       ((((dlci) & 0x3f) << 2) | \
 					    ((cr) << 1) | 0x01)

subsys/bluetooth/host/scan.c

@@ -602,6 +602,24 @@ void bt_hci_le_adv_ext_report(struct net_buf *buf)
 		is_report_complete = data_status == BT_HCI_LE_ADV_EVT_TYPE_DATA_STATUS_COMPLETE;
 		more_to_come = data_status == BT_HCI_LE_ADV_EVT_TYPE_DATA_STATUS_PARTIAL;
 
+		if (evt->length > buf->len) {
+			LOG_WRN("Adv report corrupted (wants %u out of %u)", evt->length, buf->len);
+
+			net_buf_reset(buf);
+
+			if (evt_type & BT_HCI_LE_ADV_EVT_TYPE_LEGACY) {
+				return;
+			}
+
+			/* Start discarding irrespective of the `more_to_come` flag. We
+			 * assume we may have lost a partial adv report in the truncated
+			 * data.
+			 */
+			reassembling_advertiser.state = FRAG_ADV_DISCARDING;
+
+			return;
+		}
+
 		if (evt_type & BT_HCI_LE_ADV_EVT_TYPE_LEGACY) {
 			/* Legacy advertising reports are complete.
 			 * Create event immediately.

subsys/bluetooth/host/sdp.c

@@ -115,7 +115,7 @@ struct select_attrs_data {
 	uint16_t                        max_att_len;
 	uint16_t                        att_list_len;
 	uint8_t                         cont_state_size;
-	uint8_t                         num_filters;
+	size_t                          num_filters;
 	bool                         new_service;
 };
 
@@ -814,7 +814,7 @@ static uint8_t select_attrs(struct bt_sdp_attribute *attr, uint8_t att_idx,
 	struct select_attrs_data *sad = user_data;
 	uint16_t att_id_lower, att_id_upper, att_id_cur, space;
 	uint32_t attr_size, seq_size;
-	uint8_t idx_filter;
+	size_t idx_filter;
 
 	for (idx_filter = 0U; idx_filter < sad->num_filters; idx_filter++) {
 
@@ -939,7 +939,7 @@ static uint8_t select_attrs(struct bt_sdp_attribute *attr, uint8_t att_idx,
  *  @return len Length of the attribute list created
  */
 static uint16_t create_attr_list(struct bt_sdp *sdp, struct bt_sdp_record *record,
-			      uint32_t *filter, uint8_t num_filters,
+			      uint32_t *filter, size_t num_filters,
 			      uint16_t max_att_len, uint8_t cont_state_size,
 			      uint8_t next_att, struct search_state *state,
 			      struct net_buf *rsp_buf)
@@ -978,12 +978,13 @@ static uint16_t create_attr_list(struct bt_sdp *sdp, struct bt_sdp_record *recor
  *   IDs, the lower 2 bytes contain the ID and the upper 2 bytes are set to
  *   0xFFFF. For attribute ranges, the lower 2bytes indicate the start ID and
  *   the upper 2bytes indicate the end ID
+ *  @param max_filters Max element slots of filter to be filled in
  *  @param num_filters No. of filter elements filled in (to be returned)
  *
  *  @return 0 for success, or relevant error code
  */
 static uint16_t get_att_search_list(struct net_buf *buf, uint32_t *filter,
-				 uint8_t *num_filters)
+				 size_t max_filters, size_t *num_filters)
 {
 	struct bt_sdp_data_elem data_elem;
 	uint16_t res;
@@ -998,6 +999,11 @@ static uint16_t get_att_search_list(struct net_buf *buf, uint32_t *filter,
 	size = data_elem.data_size;
 
 	while (size) {
+		if (*num_filters >= max_filters) {
+			LOG_WRN("Exceeded maximum array length %u of %p", max_filters, filter);
+			return 0;
+		}
+
 		res = parse_data_elem(buf, &data_elem);
 		if (res) {
 			return res;
@@ -1075,7 +1081,8 @@ static uint16_t sdp_svc_att_req(struct bt_sdp *sdp, struct net_buf *buf,
 	struct net_buf *rsp_buf;
 	uint32_t svc_rec_hdl;
 	uint16_t max_att_len, res, att_list_len;
-	uint8_t num_filters, cont_state_size, next_att = 0U;
+	size_t num_filters;
+	uint8_t cont_state_size, next_att = 0U;
 
 	if (buf->len < 6) {
 		LOG_WRN("Malformed packet");
@@ -1086,7 +1093,7 @@ static uint16_t sdp_svc_att_req(struct bt_sdp *sdp, struct net_buf *buf,
 	max_att_len = net_buf_pull_be16(buf);
 
 	/* Set up the filters */
-	res = get_att_search_list(buf, filter, &num_filters);
+	res = get_att_search_list(buf, filter, ARRAY_SIZE(filter), &num_filters);
 	if (res) {
 		/* Error in parsing */
 		return res;
@@ -1191,7 +1198,8 @@ static uint16_t sdp_svc_search_att_req(struct bt_sdp *sdp, struct net_buf *buf,
 	struct bt_sdp_att_rsp *rsp;
 	struct bt_sdp_data_elem_seq *seq = NULL;
 	uint16_t max_att_len, res, att_list_len = 0U;
-	uint8_t num_filters, cont_state_size, next_svc = 0U, next_att = 0U;
+	size_t num_filters;
+	uint8_t cont_state_size, next_svc = 0U, next_att = 0U;
 	bool dry_run = false;
 
 	res = find_services(buf, matching_recs);
@@ -1207,7 +1215,7 @@ static uint16_t sdp_svc_search_att_req(struct bt_sdp *sdp, struct net_buf *buf,
 	max_att_len = net_buf_pull_be16(buf);
 
 	/* Set up the filters */
-	res = get_att_search_list(buf, filter, &num_filters);
+	res = get_att_search_list(buf, filter, ARRAY_SIZE(filter), &num_filters);
 
 	if (res) {
 		/* Error in parsing */
@@ -1750,6 +1758,11 @@ static int sdp_client_receive(struct bt_l2cap_chan *chan, struct net_buf *buf)
 
 	switch (hdr->op_code) {
 	case BT_SDP_SVC_SEARCH_ATTR_RSP:
+		/* Check the buffer len for the length field */
+		if (buf->len < sizeof(uint16_t)) {
+			LOG_ERR("Invalid frame payload length");
+			return 0;
+		}
 		/* Get number of attributes in this frame. */
 		frame_len = net_buf_pull_be16(buf);
 		/* Check valid buf len for attribute list and cont state */

subsys/bluetooth/services/ots/ots_client.c

@@ -297,6 +297,11 @@ static void olcp_ind_handler(struct bt_conn *conn,
 	enum bt_gatt_ots_olcp_proc_type op_code;
 	struct net_buf_simple net_buf;
 
+	if (length < sizeof(op_code)) {
+		LOG_DBG("Invalid indication length: %u", length);
+		return;
+	}
+
 	net_buf_simple_init_with_data(&net_buf, (void *)data, length);
 
 	op_code = net_buf_simple_pull_u8(&net_buf);
@@ -304,6 +309,12 @@ static void olcp_ind_handler(struct bt_conn *conn,
 	LOG_DBG("OLCP indication");
 
 	if (op_code == BT_GATT_OTS_OLCP_PROC_RESP) {
+		if (net_buf.len < (sizeof(uint8_t) + sizeof(uint8_t))) {
+			LOG_DBG("Invalid indication length for op_code %u: %u", op_code,
+				net_buf.len);
+			return;
+		}
+
 		enum bt_gatt_ots_olcp_proc_type req_opcode =
 			net_buf_simple_pull_u8(&net_buf);
 		enum bt_gatt_ots_olcp_res_code result_code =
@@ -366,6 +377,11 @@ static void oacp_ind_handler(struct bt_conn *conn,
 	uint32_t checksum;
 	struct net_buf_simple net_buf;
 
+	if (length < sizeof(op_code)) {
+		LOG_DBG("Invalid indication length: %u", length);
+		return;
+	}
+
 	net_buf_simple_init_with_data(&net_buf, (void *)data, length);
 
 	op_code = net_buf_simple_pull_u8(&net_buf);

subsys/mgmt/hawkbit/hawkbit.c

@@ -81,7 +81,6 @@ static struct hawkbit_context {
 	uint8_t *response_data;
 	int32_t json_action_id;
 	size_t url_buffer_size;
-	size_t status_buffer_size;
 	struct hawkbit_download dl;
 	struct http_request http_req;
 	struct flash_img_context flash_ctx;
@@ -851,7 +850,7 @@ static bool send_request(enum http_method method, enum hawkbit_http_request type
 
 		ret = json_obj_encode_buf(json_cfg_descr, ARRAY_SIZE(json_cfg_descr), &cfg,
 					  hb_context.status_buffer,
-					  hb_context.status_buffer_size - 1);
+					  sizeof(hb_context.status_buffer));
 		if (ret) {
 			LOG_ERR("Can't encode the JSON script (HAWKBIT_CONFIG_DEVICE): %d", ret);
 			return false;
@@ -881,7 +880,7 @@ static bool send_request(enum http_method method, enum hawkbit_http_request type
 
 		ret = json_obj_encode_buf(json_close_descr, ARRAY_SIZE(json_close_descr), &close,
 					  hb_context.status_buffer,
-					  hb_context.status_buffer_size - 1);
+					  sizeof(hb_context.status_buffer));
 		if (ret) {
 			LOG_ERR("Can't encode the JSON script (HAWKBIT_CLOSE): %d", ret);
 			return false;
@@ -928,7 +927,7 @@ static bool send_request(enum http_method method, enum hawkbit_http_request type
 
 		ret = json_obj_encode_buf(json_dep_fbk_descr, ARRAY_SIZE(json_dep_fbk_descr),
 					  &feedback, hb_context.status_buffer,
-					  hb_context.status_buffer_size - 1);
+					  sizeof(hb_context.status_buffer));
 		if (ret) {
 			LOG_ERR("Can't encode the JSON script (HAWKBIT_REPORT): %d", ret);
 			return ret;

subsys/mgmt/updatehub/updatehub.c

@@ -847,19 +847,31 @@ enum updatehub_response z_impl_updatehub_probe(void)
 				   recv_probe_sh_string_descr,
 				   ARRAY_SIZE(recv_probe_sh_string_descr),
 				   &metadata_any_boards) < 0) {
-			LOG_ERR("Could not parse json");
+			LOG_ERR("Could not parse the json");
 			ctx.code_status = UPDATEHUB_METADATA_ERROR;
 			goto cleanup;
 		}
 
+		LOG_DBG("elements: %d", metadata_any_boards.objects_len);
+		for (size_t i = 0; i < metadata_any_boards.objects_len; ++i) {
+			LOG_DBG("obj[%d].elements: %d",
+				i, metadata_any_boards.objects[i].objects_len);
+			for (size_t j = 0; j < metadata_any_boards.objects[i].objects_len; ++j) {
+				struct resp_probe_objects *obj =
+					&metadata_any_boards.objects[i].objects[j].objects;
+				LOG_DBG("\tMode: %s\n\tSHA: %s\n\tSize: %d",
+					obj->mode, obj->sha256sum, obj->size);
+			}
+		}
+
 		if (metadata_any_boards.objects_len != 2) {
-			LOG_ERR("Could not parse json");
+			LOG_ERR("Object length of type 'any metadata' is incorrect");
 			ctx.code_status = UPDATEHUB_METADATA_ERROR;
 			goto cleanup;
 		}
 
 		sha256size = strlen(
-			metadata_any_boards.objects[1].objects.sha256sum) + 1;
+			metadata_any_boards.objects[1].objects[0].objects.sha256sum) + 1;
 
 		if (sha256size != SHA256_HEX_DIGEST_SIZE) {
 			LOG_ERR("SHA256 size is invalid");
@@ -868,14 +880,26 @@ enum updatehub_response z_impl_updatehub_probe(void)
 		}
 
 		memcpy(update_info.sha256sum_image,
-		       metadata_any_boards.objects[1].objects.sha256sum,
+		       metadata_any_boards.objects[1].objects[0].objects.sha256sum,
 		       SHA256_HEX_DIGEST_SIZE);
-		update_info.image_size = metadata_any_boards.objects[1].objects.size;
+		update_info.image_size = metadata_any_boards.objects[1].objects[0].objects.size;
 		LOG_DBG("metadata_any: %s",
 			update_info.sha256sum_image);
 	} else {
+		LOG_DBG("elements: %d\n", metadata_some_boards.objects_len);
+		for (size_t i = 0; i < metadata_some_boards.objects_len; ++i) {
+			LOG_DBG("obj[%d].elements: %d\n",
+				i, metadata_some_boards.objects[i].objects_len);
+			for (size_t j = 0; j < metadata_some_boards.objects[i].objects_len; ++j) {
+				struct resp_probe_objects *obj =
+					&metadata_some_boards.objects[i].objects[j].objects;
+				LOG_DBG("\tMode: %s\n\tSHA: %s\n\tSize: %d\n",
+					obj->mode, obj->sha256sum, obj->size);
+			}
+		}
+
 		if (metadata_some_boards.objects_len != 2) {
-			LOG_ERR("Could not parse json");
+			LOG_ERR("Object length of type 'some metadata' is incorrect");
 			ctx.code_status = UPDATEHUB_METADATA_ERROR;
 			goto cleanup;
 		}
@@ -888,7 +912,7 @@ enum updatehub_response z_impl_updatehub_probe(void)
 		}
 
 		sha256size = strlen(
-			metadata_some_boards.objects[1].objects.sha256sum) + 1;
+			metadata_some_boards.objects[1].objects[0].objects.sha256sum) + 1;
 
 		if (sha256size != SHA256_HEX_DIGEST_SIZE) {
 			LOG_ERR("SHA256 size is invalid");
@@ -897,10 +921,10 @@ enum updatehub_response z_impl_updatehub_probe(void)
 		}
 
 		memcpy(update_info.sha256sum_image,
-		       metadata_some_boards.objects[1].objects.sha256sum,
+		       metadata_some_boards.objects[1].objects[0].objects.sha256sum,
 		       SHA256_HEX_DIGEST_SIZE);
 		update_info.image_size =
-			metadata_some_boards.objects[1].objects.size;
+			metadata_some_boards.objects[1].objects[0].objects.size;
 		LOG_DBG("metadata_some: %s",
 			update_info.sha256sum_image);
 	}
@@ -942,7 +966,7 @@ enum updatehub_response z_impl_updatehub_update(void)
 
 	if (updatehub_storage_mark_partition_to_upgrade(&ctx.storage_ctx,
 							UPDATEHUB_SLOT_PARTITION_1)) {
-		LOG_ERR("Could not reporting downloaded state");
+		LOG_ERR("Could not mark partition to upgrade");
 		ctx.code_status = UPDATEHUB_INSTALL_ERROR;
 		goto error;
 	}

subsys/mgmt/updatehub/updatehub_priv.h

@@ -97,15 +97,20 @@ struct resp_probe_objects_array {
 	struct resp_probe_objects objects;
 };
 
+struct resp_probe_objects_array_array {
+	struct resp_probe_objects_array objects[4];
+	size_t objects_len;
+};
+
 struct resp_probe_any_boards {
-	struct resp_probe_objects_array objects[2];
+	struct resp_probe_objects_array_array objects[2];
 	size_t objects_len;
 	const char *product;
 	const char *supported_hardware;
 };
 
 struct resp_probe_some_boards {
-	struct resp_probe_objects_array objects[2];
+	struct resp_probe_objects_array_array objects[2];
 	size_t objects_len;
 	const char *product;
 	const char *supported_hardware[CONFIG_UPDATEHUB_SUPPORTED_HARDWARE_MAX];
@@ -148,6 +153,13 @@ static const struct json_obj_descr recv_probe_objects_descr_array[] = {
 			      objects, recv_probe_objects_descr),
 };
 
+static const struct json_obj_descr recv_probe_objects_descr_array_array[] = {
+	JSON_OBJ_DESCR_ARRAY_ARRAY(struct resp_probe_objects_array_array,
+				   objects, 4, objects_len,
+				   recv_probe_objects_descr_array,
+				   ARRAY_SIZE(recv_probe_objects_descr_array)),
+};
+
 static const struct json_obj_descr recv_probe_sh_string_descr[] = {
 	JSON_OBJ_DESCR_PRIM(struct resp_probe_any_boards,
 			    product, JSON_TOK_STRING),
@@ -156,8 +168,8 @@ static const struct json_obj_descr recv_probe_sh_string_descr[] = {
 				  JSON_TOK_STRING),
 	JSON_OBJ_DESCR_ARRAY_ARRAY(struct resp_probe_any_boards,
 				   objects, 2, objects_len,
-				   recv_probe_objects_descr_array,
-				   ARRAY_SIZE(recv_probe_objects_descr_array)),
+				   recv_probe_objects_descr_array_array,
+				   ARRAY_SIZE(recv_probe_objects_descr_array_array)),
 };
 
 static const struct json_obj_descr recv_probe_sh_array_descr[] = {
@@ -169,8 +181,8 @@ static const struct json_obj_descr recv_probe_sh_array_descr[] = {
 				   supported_hardware_len, JSON_TOK_STRING),
 	JSON_OBJ_DESCR_ARRAY_ARRAY(struct resp_probe_some_boards,
 				   objects, 2, objects_len,
-				   recv_probe_objects_descr_array,
-				   ARRAY_SIZE(recv_probe_objects_descr_array)),
+				   recv_probe_objects_descr_array_array,
+				   ARRAY_SIZE(recv_probe_objects_descr_array_array)),
 };
 
 static const struct json_obj_descr device_identity_descr[] = {