Commit graph zephyr/scripts
Author SHA1 Message Date
Benjamin Cabé
a1fd6280eb scripts: zspdx: scanner: only look up REUSE.toml above scanned files
Project.from_directory() globs the whole component tree for REUSE.toml
and drops ignored paths only afterwards. The zephyr-sources component
is rooted at the west topdir, which is not a git repository, so every
run walked all modules, virtualenvs and build directories in the
workspace: 86 s for hello_world in a workspace with many worktrees.

A REUSE.toml only covers its own directory tree, so only check the
ancestor directories of the files being scanned and build the Project
from those. The generated documents are unchanged; the same run takes
2.4 s.

The slowdown came with commit bc14cfbb1b ("scripts: zspdx: scanner:
load REUSE.toml, surface its licenses").

Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
Assisted-by: Claude:opus-5.5
2026-10-13 09:40:19 +02:00
Mario Jaun
a8cdae5206 twister: harness: gtest: keep all name segments of parameterized tests
Match the complete name GoogleTest prints and derive the internal test
name from it by replacing "/" with ".", so no index or generator name
can be lost. This supports TEST, TEST_F, TYPED_TEST, TYPED_TEST_P and
TEST_P, each with a default or custom name and, for TEST_P, with or
without an instantiation prefix.

Fixes: ba480d810b ("twister: add support for gtest parametrized tests")
Signed-off-by: Mario Jaun <mario.jaun@zuehlke.com>
2026-10-12 23:39:20 +02:00
Benjamin Cabé
a9bafb62a7 tests: spdx: cover SPDX 3 element IDs of separate builds
Check that two builds with different namespace prefixes define no
element under the same IRI, that document IDs are full IRIs under the
prefix, and that every imported element is defined by the sibling
document its locationHint names.

Assisted-by: Claude:opus-5.5
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
2026-10-12 23:33:39 +02:00
Benjamin Cabé
e67f2941dd scripts: zspdx: make SPDX 3 element IDs unique to each build
SPDX 3 element IDs were shortened to "zephyr:..." through namespaceMap,
which JSON-LD consumers do not expand, and License List licenses were
defined at their https://spdx.org/licenses/ IRIs. Both are the same IRIs
in every build, so the documents of separate builds, such as sysbuild
images, merged into conflicting elements when combined.

Write full IRIs under the namespace prefix, and define License List
licenses as license expressions in that namespace like custom ones.

Assisted-by: Claude:opus-5.5
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
2026-10-12 23:33:39 +02:00
Tom Burdick
0eb7a97a9c scripts: coverage_analysis: Check for existence of name property
The coverage analysis script was failing at times trying to add covered
function names to the list of covered functions in the report. The name
property of the i_fun object was being accessed without checking to see
if the property existed resulting in a python exception.

This property may not exist for many reasons including inlining.

Additionally fix a small typo in the variable names, correcting the
misspelled word function.

Signed-off-by: Tom Burdick <thomas.burdick@infineon.com>
2026-10-11 17:28:58 +02:00
Jeremy Bettis
11808e9ea8 twister: handlers: extend post-status timeout when coverage is enabled
When running native_sim tests with --coverage, harness.capture_coverage
is False (it is only True when dumping coverage over serial console with
CONFIG_COVERAGE_DUMP). Once a test prints its final pass status,
BinaryHandler._output_handler resets timeout_time to time.time() + 2
and waits for stdout EOF before calling proc.wait(0.1) and terminate().

Under heavy parallel I/O, __gcov_exit() can take longer than 2.6s to
write all .gcda files before exiting and closing stdout, causing Twister
to SIGKILL zephyr.exe mid-__gcov_exit() and leave truncated 0-byte or
missing .gcda files. Extend timeout_time by COVERAGE_TIMEOUT_EXTENSION
(30s) when self.options.enable_coverage is set.

Signed-off-by: Jeremy Bettis <jbettis@google.com>
2026-10-10 13:00:25 +02:00
Benjamin Cabé
bb3b809b4d scripts: zspdx: stop computing MD5 file hashes
ScannerConfig.do_md5 was off by default and nothing enables it, so
every file was hashed with MD5 only for the result to be discarded.
Drop the MD5 hash, its option and its serializer branches, and remove
MD5 from the hashes the documentation lists.

Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
Assisted-by: Claude:opus-5.5
2026-10-09 17:02:10 +02:00
Benjamin Cabé
709f843aa4 scripts: zspdx: record SHA512 file hashes
Compute a SHA512 hash for every file alongside SHA1 and SHA256, and
emit it as a FileChecksum in SPDX 2.x and as a verifiedUsing hash in
SPDX 3.x. Like SHA256, it is enabled by default through
ScannerConfig.do_sha512.

Extend the SBOM integration test to check the SHA512 of main.c.

Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
Assisted-by: Claude:opus-5.5
2026-10-09 17:02:10 +02:00
Matthew Zhao
d0df0fe5ad llext: build: fix parsing additional equal signs (=) in prj.conf
When llext is enabled and there is a conf in 'prj.conf' that contains more
than 2 equal signs (=) on a single line the script will get a ValueError
and crash due to unpacking too many values.

The fix is changing line.split("=") to line.split("=", 1) on line 77
to ensure it will only split the key values at the first = sign. This
fixes if a conf contains something such as:

    CONFIG_LLEXT=y
    CONFIG_QEMU_EXTRA_FLAGS="tag=myfs share=on queue-size=1024"

where the 2nd line of the config will be split in two parts instead
of at every equal sign.

Signed-off-by: Matthew Zhao <matthewzhao.zy@gmail.com>
2026-10-09 16:53:10 +02:00
Marc Herbert
d9f79d97d3 west: blobs: cosmetic: add/fix some comments and function names
Focus on mitigating the confusion between "fetch", "get" and
"download".

With the (useful!) addition of caching and mirroring, the complexity
of blobs.py has increased and the call graph and invariants have
become harder and harder to wrap one's head around. This had made
reviews more difficult and time-consuming, see for instance the small
but surprisingly tricky
https://github.com/zephyrproject-rtos/zephyr/pull/118054

Add and fix some comments and function names to try to reduce that
workload.

Signed-off-by: Marc Herbert <marc.herbert@gmail.com>
2026-10-09 08:36:05 +02:00
Benjamin Cabé
fbbd495fb6 scripts: dts: dtdoctor: handle an unset ZEPHYR_BASE
setup_kconfig() raised TypeError when ZEPHYR_BASE was unset. Fall back
to a "check driver Kconfig manually" hint instead.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
2026-10-08 08:03:19 +02:00
Benjamin Cabé
e1e49c8dba scripts: dts: dtdoctor: fix Kconfig select/imply and symbol matching
select/imply conditions never matched, and substring matching made
DT_HAS_FOO_ENABLED also match DT_HAS_FOO_ENABLED_<X>. Match the
conditions, on word boundaries.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
2026-10-08 08:03:19 +02:00
Benjamin Cabé
a18fbefe99 scripts: dts: dtdoctor: fix alias references of disabled nodes
EDT has no 'aliases' attribute, so the aliases referring to a disabled
node were never reported. Use node.aliases.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
2026-10-08 08:03:19 +02:00
Benjamin Cabé
d338a4488b scripts: dts: dtdoctor: strip wrapper options without a separator
Without '--', the wrapper ran its whole argv, '--edt-pickle' included,
as the compiler command. Run what parse_known_args() leaves over
instead.

Assisted-by: Claude
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
2026-10-08 08:03:19 +02:00
Benjamin Cabé
312837c849 scripts: dts: dtdoctor: fix toolchain error detection regexes
The lld pattern expected a '(' that lld never prints, the gcc one missed
the function-scope message, and nothing matched g++'s "was not declared
in this scope", so these errors were never diagnosed.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
2026-10-08 08:03:19 +02:00
Benjamin Cabé
ab6c2036d4 tests: misc: dtdoctor: add unit tests for the DT Doctor scripts
Add a pytest suite for the DT Doctor wrapper and analyzer, run by
twister as a ctest entry of a minimal test application. EDTs are built
from inline DTS snippets with small fixture bindings and Kconfig trees.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
2026-10-08 08:03:19 +02:00
Pisit Sawangvonganan
228b0e4c72 scripts: {build, native_simulator, pylib, tests, west_commands}: fix typo
Utilize a code spell-checking tool to scan for and correct spelling errors
in all files within:
- `scripts/build`
- `scripts/native_simulator`
- `scripts/pylib`
- `scripts/tests`
- `scripts/west_commands`

Assisted-by: Claude:claude-sonnet-5-5 codespell
Signed-off-by: Pisit Sawangvonganan <pisit@ndrsolution.com>
2026-10-06 07:31:14 +02:00
Jamie McCrae
d65f1e67ae scripts: pylib: twister: Fail on deprecated Kconfigs in integration
When the command line argument for twister is used to treat
warnings as errors, will also set the same option for treating
deprecated Kconfigs as errors, this allows CI compliance to ensure
that the API lifecycle process is followed

Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
2026-10-03 09:02:05 -05:00
Anas Nashif
67a39fe086 twister: drop stale instance reasons before a run
The handlers fill in a reason of their own, such as the exit code,
only when the instance has none. The JSON report, however, writes a
placeholder reason, "Unknown Instance status", for every suite that
has not run, which is every suite in a test plan saved before
running, and loading that plan with --load-tests restores the
placeholder along with the unset status. A run that then fails
keeps the placeholder over the exit code, which is how CI reports
a QEMU that could not start.

Write no reason for a suite that has not run, do not restore one
for such a suite from a loaded plan, and clear the reason together
with the status before every run so that neither a loaded plan nor
an earlier retry iteration can leak one into the new result.

Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
2026-10-02 17:42:11 -05:00
Anas Nashif
d2c91c0018 twister: qemu: stop monitoring when QEMU exits without starting
The QEMU monitor thread opens the console fifos as QEMU's
counterpart, and each of those opens blocks until QEMU opens the
other end. When the run command fails to start QEMU at all, the
thread sits in open() with nothing to wait for while the handler
joins it for the whole test timeout: a QEMU binary that cannot be
executed costs the full timeout per test, several minutes in CI,
before being reported as a timeout.

Once the run command has exited, give the thread a moment to drain
what QEMU left in the pipe. If it is still around after that it is
blocked on the fifos, so connect to them in QEMU's place and
disconnect again: the opens return, the thread reads EOF and
finishes at once. If QEMU never wrote its pid file, drop the EOF
reason the thread recorded so the exit code names the failure.

Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
2026-10-02 17:42:11 -05:00
Anas Nashif
79eeb2d6e6 twister: qemu: report what the run command wrote to stderr
The QEMU handler captures the run command's stderr to qemu.stderr, a
file nothing reads: neither the inline log printed for a failure nor
the JSON report look at it. When QEMU cannot start at all, because
the binary is not found, refuses an option or fails to load a
library, the console log stays empty and twister prints build.log,
a log of a build that succeeded, and records nothing about why the
test did not run.

Capture that stderr as handler_stderr.log instead, the file the
binary handler already uses and that both the inline log and the
JSON report read. The run command's stdout stays in qemu.stdout.

The inline log printed for a failure also appends handler_stderr.log
to a non-empty console log, as the JSON report already does, so a
console log that stops short comes with the stderr that explains it.

Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
2026-10-02 17:42:11 -05:00
Hossein Sagha
e735e63b8f scripts: build: fix missing const in shared ISR table declaration
When CONFIG_DYNAMIC_INTERRUPTS is disabled and
CONFIG_ISR_TABLES_LOCAL_DECLARATION is enabled, the ISR table
generator emits z_shared_sw_isr_table without a const qualifier.
The header include/zephyr/sw_isr_table.h declares this symbol as
const in the same configuration. Without LTO this mismatch is
benign, but with -flto=auto GCC performs whole-program type
checking and rejects the conflicting types.

The other generator path, gen_isr_tables_parser_carrays.py, already
adds const in this case. Apply the same logic in
gen_isr_tables_parser_local.py so the generated declaration matches
the header.

Build verified with CONFIG_SHARED_INTERRUPTS=y, CONFIG_LTO=y,
CONFIG_ISR_TABLES_LOCAL_DECLARATION=y, and
CONFIG_DYNAMIC_INTERRUPTS=n.

Fixes zephyrproject-rtos/zephyr#119726

Signed-off-by: Hossein Sagha <HoseinSagha@gmail.com>
2026-10-02 08:26:32 -05:00
Henrik Brix Andersen
0f559afa50 scripts: requirements: actions: refresh pinned versions
Run the uv command to update the pinned versions in
requirements-actions.txt.

Signed-off-by: Henrik Brix Andersen <hebad@vestas.com>
2026-09-30 13:16:30 -05:00
Henrik Brix Andersen
fb0969df5e scripts: requirements: actions: basic: refresh pinned versions
Run the uv command to update the pinned versions in
requirements-actions-basic.txt.

Signed-off-by: Henrik Brix Andersen <hebad@vestas.com>
2026-09-30 13:16:30 -05:00
Sylvio Alves
9a2c696cb6 scripts: gen_syscalls: drop not-emit id of an emitted syscall
A syscall declared in both a registered header and a merely
scanned header was assigned two ids: a low one below
K_SYSCALL_LIMIT and a high one above it. The second definition
wins for every user of the header, so the call is rejected as
out of range.

Skip the duplicate id while still emitting the invocation
wrapper, which the scanned header needs to compile. Also drop a
repeated wrapper within one header and a repeated not-emit id,
both of which produced a redefinition.

Assisted-by: Claude:opus-5
Signed-off-by: Sylvio Alves <sylvio.alves@espressif.com>
2026-09-30 19:36:38 +02:00
Carlo Kirchmeier
b8babe208f tests: net: mdns: add offloaded-socket mDNS test
Add a pytest/zeroconf integration test verifying the mDNS responder
answers over offloaded sockets (NSOS) on native_sim, for both IPv4 and
IPv6.

Signed-off-by: Carlo Kirchmeier <carlo.kirchmeier.ext@siemens.com>
2026-09-30 17:59:42 +02:00
Flavio Ceolin
0ba83fe741 scripts: coccinelle: check for callback in syscall
A syscall that passes a callback lets userspace place a function that the
kernel will call, redirecting execution to an arbitrary address
(CWE-822). Match the three shapes this takes: a plain forward, one behind
a redundant cast, and a function-pointer typedef named cb.

Signed-off-by: Flavio Ceolin <flavio@hubble.com>
2026-09-30 10:27:00 -05:00
Benjamin Cabé
4afcc0350c scripts: parse_syscalls: skip files without any syscall marker
parse_syscalls.py reads about 7000 headers and C files on the serial
part of the build, before anything else can compile, and runs three
regexes over each one. Only about 150 of them contain a marker any of
those regexes can match (__syscall, __subsystem, __net_socket or
DEVICE_API_EXTENDS).

Test for the markers with substring searches and skip the regexes on
files that contain none. Also normalize paths with os.path instead of
building a PurePath per file. Every file is still read and decoded.

Standalone, with the directories the build scans, this takes the
script from 494 ms to 358 ms on macOS (hyperfine, mean of 15 runs).
syscalls.json and the struct tags file are byte-identical.

Assisted-by: Claude:opus-5.5
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
2026-09-30 10:21:58 -05:00
Aleksandr Dobkin
ddef1434c4 tests: runners: add dfu-util detach tests
Cover the explicit detach flow and verify that the runner downloads the
image before issuing the separate dfu-util -e request. Also cover DfuSe
leave to ensure it suppresses the redundant detach request.

Assisted-by: ChatGPT:gpt-5.6-sol
Signed-off-by: Aleksandr Dobkin <alex@dobk.in>
2026-09-30 12:55:02 +02:00
Aleksandr Dobkin
e9220d5b79 runners: dfu-util: add detach support
Add an optional --detach argument that issues a separate dfu-util -e
request after a successful download. This supports DFU devices that need
an explicit detach request before starting the downloaded image.

Skip the separate detach when DfuSe already uses the leave modifier,
since the device may already have left DFU mode.

Assisted-by: ChatGPT:gpt-5.6-sol
Signed-off-by: Aleksandr Dobkin <alex@dobk.in>
2026-09-30 12:55:02 +02:00
Aleksandr Dobkin
bfa665ba64 scripts: west: format dfu-util files
Format the dfu-util runner and its tests with Ruff so future changes do
not mix legacy formatting with functional diffs. Remove both files from
the Ruff format exclusion list now that they are formatted.

Assisted-by: ChatGPT:gpt-5.6-sol
Signed-off-by: Aleksandr Dobkin <alex@dobk.in>
2026-09-30 12:55:02 +02:00
Måns Ansgariusson
ca84cb49b6 debug: zassert: cocci
Hopefully a script that helps the zassert migration for various subsystems.

1. ./scripts/coccicheck --mode=patch \
	--cocci=subsys/debug/zassert/zassert.cocci ${path} > patch.diff
2. git apply patch.diff
3. Pray to what ever deity you feel like and verify

Known limitations:
* It will not be able to add a ZASSERT_MODULE(...) to the TUs it modifies,
  so you will have to do that manually.
* It will not know the distinction between a .c and .h file so it will not
  add the ZASSERT_MODULE(...) neccesary for the .h files. You will have to
  do that manually as well.

Signed-off-by: Måns Ansgariusson <mansgariusson@gmail.com>
2026-09-30 12:50:59 +02:00
Sylvio Alves
d9e948c33e scripts: west: key the runner policy dedup on the resolved path
The processed set was keyed on the raw cache string, so two
spellings of one directory both loaded the same policy file, took
the same priority and aborted the run as a duplicate
configuration. Key on the resolved directory instead, and track
SoC and board directories in separate sets so each file kind is
deduplicated on its own.

Move the gathering into a helper so the tests drive the code that
west runs, and log the policy file that is discarded when it does
not exist, which was silent before.

Assisted-by: Claude:opus-5
Signed-off-by: Sylvio Alves <sylvio.alves@espressif.com>
2026-09-30 12:43:30 +02:00
Sylvio Alves
975c492747 scripts: list_boards: resolve the board-dir argument
The --board-dir branch builds the board file list straight from
the argument, skipping the resolve() that --board-root goes
through. Resolve it the same way so the DIR fed back to CMake is
always absolute and symlink-free.

Assisted-by: Claude:opus-5
Signed-off-by: Sylvio Alves <sylvio.alves@espressif.com>
2026-09-30 12:43:30 +02:00
Benjamin Cabé
bc66c2e5dc scripts: build: gen_kobject_list: drop decoder API Kconfig gates
struct sensor_decoder_api and struct adc_decoder_api are defined
unconditionally and several drivers instantiate a decoder even when
CONFIG_SENSOR_ASYNC_API or CONFIG_ADC_STREAM is disabled. The gperf
table then names K_OBJ_SENSOR_DECODER_API while the generated enum
hides it behind the Kconfig, so the hash table fails to compile. Emit
both enumerators unconditionally.

Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
Assisted-by: Claude:opus-5
2026-09-30 12:42:04 +02:00
Steve Rae
d9b2c25cd0 west: blobs: implement "blobs.mirrors" configuration
Process the "blobs.mirrors" configuration rules and update the list of blob
URLs accordingly, so a configured mirror could be used instead of the
upstream URL. This reduces rate-limiting and connectivity issues when
fetching blobs from github.com.

Assisted-by: GitHub Copilot:Claude Sonnet 5

Signed-off-by: Steve Rae <Steve.Rae@infineon.com>
2026-09-30 12:40:21 +02:00
Egemen Tuncarslan
49e96b6ca7 west: zcmake: number CMakeCache lines from one
CMakeCache.load() counted lines from 0, so the "on line N" in the error
for an invalid BOOL entry was one less than the line an editor shows.
Count from 1 instead.

Assisted-by: Claude:claude-opus-5.5
Signed-off-by: Egemen Tuncarslan <egementuncarslan@hotmail.com>
2026-09-30 12:37:11 +02:00
Benjamin Cabé
7615172776 scripts: ci: check_compliance: validate hardening database
Add a check_hardening_data step to KconfigCheck that validates the
hardening database - the central scripts/kconfig/hardening.yaml and
every discovered hardening.yaml fragment - against the fully parsed
Kconfig tree:

- each file parses and matches its JSON schema
- profiles are only defined centrally, and no rule is defined twice
- profile references and 'extends' chains are consistent
- every rule references an existing Kconfig symbol
- recommended values are coherent with the symbol's type (y/n/m for
  bool/tristate, integers and min/max constraints for int/hex only)
- a CVE mentioned in a rule's rationale is also listed in the rule's
  references, so it is exposed as structured data and not just prose
- no file looks like a misnamed fragment that would silently not load
- no 'n' rule is redundant with an 'n' rule it depends on that
  covers at least the same profiles (rules for symbols that merely
  select a flagged symbol are kept, as they name the actionable
  option)

This is the structural fix for the staleness the CSV suffered from:
removing or renaming a Kconfig symbol now fails compliance until the
hardening database is updated, and a malformed entry can no longer be
silently ignored. Failure messages name the exact database file to fix.

The check reuses the Kconfig tree KconfigCheck already parses, so it
adds no measurable cost, and it is skipped in the KconfigBasic and
sysbuild variants where the relevant symbols are not available.

Assisted-by: Claude:fable-5
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
2026-09-29 10:40:32 +02:00
Benjamin Cabé
3484454ac8 scripts: kconfig: hardenconfig: switch to YAML hardening database
Replace scripts/kconfig/hardened.csv with a distributed YAML database.
The CSV format could not carry any explanation for its recommendations,
had no validation (a malformed line was silently dropped), no notion of
profiles, no ownership story, and no way to extend it out of tree.

The database now lives where the code lives: the central
scripts/kconfig/hardening.yaml defines the hardening profiles (plus
rules for top-level Kconfig symbols), and per-subsystem hardening.yaml
fragments next to the relevant Kconfig files carry the rules, so each
rule is reviewed by the maintainers of the code it hardens. Every rule
has a required rationale and optional references, supports exact-value
and integer min/max recommendations (STACK_POINTER_RANDOM is now
'>=100' instead of '==100'), and belongs to a profile: 'base' (memory
protection and inherently insecure features) or 'strict' (extends base
with debug/observability feature removal). The default profile is
'strict', matching the rule set the CSV checked.

hardenconfig is restructured around a serializable HardeningReport
model so results can be consumed programmatically, and gains:

- a Rationale column in the report
- profile selection:
  west build -t hardenconfig -- -DHARDENCONFIG_PROFILE=base
- HARDENCONFIG_SHOW_ALL to also list PASS/NA results
- HARDENCONFIG_STRICT to exit non-zero on failures, for CI use
- HARDENCONFIG_JSON to write machine-readable results, including which
  database file each rule came from
- HARDENCONFIG_EXTRA_SOURCES to layer out-of-tree database files that
  may add profiles/rules and override in-tree ones

The EXPERIMENTAL/DEPRECATED/NOT_SECURE marker symbol detection is
preserved unchanged.

Three CSV entries are intentionally not carried over because they were
redundant: BT_CONN_DISABLE_SECURITY and BT_OOB_DATA_FIXED can only be
enabled together with BT_TESTING, and TIMER_RANDOM_GENERATOR together
with TEST_RANDOM_GENERATOR, all of which the database already
recommends disabling for the same profiles.

Behavioral fix: the CSV's DEBUG_COREDUMP line used '=' instead of ','
and was silently ignored, so CONFIG_DEBUG_COREDUMP was never actually
checked; it now is.

Also add tabulate to requirements-base.txt: hardenconfig has always
imported it, but it was only pulled in via other requirements files.

Assisted-by: Claude:fable-5
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
2026-09-29 10:40:32 +02:00
Benjamin Cabé
0092a2fe37 scripts: kconfig: add security hardening database schema and loader
Introduce the foundation for replacing scripts/kconfig/hardened.csv with
a schema-validated, distributed YAML hardening database:

- scripts/schemas/hardening-schema.yaml: JSON Schema (Draft 2020-12) for
  the database files. Rules are keyed by Kconfig symbol name (so a
  duplicate entry within a file is a duplicate YAML key, which the
  loader rejects), require a rationale, and recommend either an exact
  value or an integer min/max constraint. Rules belong to named profiles
  which may extend one another.
- scripts/kconfig/hardeninglib.py: shared loader used by both the
  hardenconfig build target and the compliance check, so parsing and
  evaluation semantics can never drift between the two. The database is
  distributed: a central file defines the profiles, while rule
  fragments named hardening.yaml are discovered next to the subsystem,
  driver, architecture and SoC Kconfig files they relate to, keeping
  each rule under its own maintainers' review. The loader handles
  fragment discovery, schema validation, duplicate-rule rejection,
  value normalization to .config-style strings, profile resolution with
  'extends' cycle detection, and merging of additional out-of-tree
  database files.
- scripts/tests/hardenconfig/: pytest suite covering schema
  accept/reject cases, fragment discovery and merge rules, profile
  resolution, rule evaluation against a fixture Kconfig tree, value
  normalization and extra-source override, wired into the scripts tests
  workflow.

Assisted-by: Claude:fable-5
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
2026-09-29 10:40:32 +02:00
Benjamin Cabé
c1575e0b45 scripts: kconfig: hardenconfig: honor marker select conditions
The report flags every symbol whose node has a 'select EXPERIMENTAL'
(or DEPRECATED, or NOT_SECURE) without looking at the select condition,
so a conditional select such as nrf_wifi's, which only applies on
unsupported SoCs, reports the driver as experimental everywhere.

Unpack the (target, condition, location) tuples kconfiglib stores and
require the condition to be true. This also replaces a membership test
that matched a marker sitting in the condition slot rather than the
target slot.

Assisted-by: Claude:claude-opus-5.5
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
2026-09-29 10:40:32 +02:00
Egemen Tuncarslan
c793a9da05 scripts: build: update uf2conv.py to upstream f3f9f1e
Copy uf2conv.py verbatim from microsoft/uf2 f3f9f1e, adding only the
Zephyr header, and exclude it from ruff again so it can keep tracking
upstream 1-to-1. HEX input now fills gaps with 0xFF instead of 0x00,
and on Windows the drive lookup uses PowerShell instead of wmic.

uf2families.json is left as is, to keep the RP2350 name.

Assisted-by: Claude:claude-opus-5.5
Signed-off-by: Egemen Tuncarslan <egementuncarslan@hotmail.com>
2026-09-28 09:40:39 -04:00
Benjamin Cabé
a477f72859 scripts: tracing: trace_viewer: handle thread_sleep_ticks events
k_sleep() and friends now emit thread_sleep_ticks_enter/exit, which the
viewer did not treat as a sleep, so sleeping threads showed as ready.
Add them to the sleep events and to the fallback event table.

Assisted-by: Claude:opus-5.5
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
2026-09-28 07:37:31 -04:00
Yves Wang
74a43afbf2 scripts: west_commands: runners: linkserver: support --gdb-init
LinkServer sets no implicit breakpoint at the reset handler and leaves
that to the user, but the runner had no way to pass even 'b main' to the
GDB client.

Declare the capability and append the commands on 'debug' and 'attach':
after the connect, reset and load the runner issues itself, and before the
batch-mode teardown, so they take effect while the target is still halted.
flash, erase and debugserver are unaffected.

The runner had no test file; add one for the GDB client argv. The version
probe and the process launches are mocked, so no debug probe or LinkServer
installation is needed.

Signed-off-by: Yves Wang <zhengjia.wang@nxp.com>
2026-09-28 07:36:41 -04:00
Yves Wang
ff3ecd72ee scripts: west_commands: runners: jlink: support --gdb-init
There was no way to feed commands to the GDB client, so enabling J-Link
semihosting for a debug session meant editing the runner.

Declare the capability and append the commands on 'debug' and 'attach':
after the connect, load and reset the runner issues itself, and before the
target is resumed, so batch mode still ends with 'monitor go', disconnect
and quit. flash, reset, rtt and debugserver are unaffected.

The --reset sequence for 'debug' moves ahead of the appended commands so
that the reset, which leaves the CPU halted, cannot discard their effect.
Without --gdb-init the argv is unchanged.

The runner had no test file; add one for the GDB client argv. The version
probe, the build configuration and the process launches are mocked, so no
debug probe or J-Link software is needed.

Signed-off-by: Yves Wang <zhengjia.wang@nxp.com>
2026-09-28 07:36:41 -04:00
Yves Wang
864a22d3c6 scripts: west_commands: runners: make --gdb-init a capability
--gdb-init was local to the openocd and intel_cyclonev runners, so no
other runner could offer it, and runners without it silently ignored the
option. Move it to RunnerCaps, and add a gdb_ex_args() helper in place of
the open-coded '-ex' loops.

Both runners are converted here because core now registers the option for
every runner, which clashes with their local definitions. The option
string and its position in the argv are unchanged, so the twenty-two
board.cmake files using it keep working.

Add openocd tests for that argv, which had no coverage.

Signed-off-by: Yves Wang <zhengjia.wang@nxp.com>
2026-09-28 07:36:41 -04:00
Paweł Bolek
a2868f4f11 logging: dictionary: include log_strings in database_gen
When LOG_FMT_SECTION_STRIP is enabled, format strings live in the
log_strings ELF section. Merge NUL-terminated entries into
string_mappings before parsing log instances so the JSON database
stays complete under LTO/strip.

Fixes #115815

Signed-off-by: Paweł Bolek <pawelbolek.biz@gmail.com>
2026-09-28 07:35:48 -04:00
Anas Nashif
79f8ce2ca4 twister: restore substring match of platform extra args
Commit 11c210cec9 ("twister: match platform extra args against
aliases") replaced the substring match of platform:<selector>:<arg>
against the platform name with an exact match against its aliases.
Selectors that name only part of a board target, such as
platform:nrf54l:shell_remote_SNIPPET=nordic-flpr, no longer apply. For
example, shell.shell_remote.no_multithreading on
nrf54l15dk/nrf54l15/cpuapp builds the remote image for the application
core and fails with "No IPC node found".

Match the selector as a substring of the platform name as before, and
additionally as an exact alias so a default board target still selects
its default revision. Add a test case for a partial selector.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
2026-09-28 10:55:59 +02:00
Jukka Rissanen
1ee3b93134 ci: net: Run the protocol conformance suites nightly
Nothing runs the TTCN-3 conformance suites, so nothing notices when one
of them starts failing. Add a workflow that runs them.

They stay out of the ordinary Twister run on purpose. They need a Titan
installation, a network interface facing the device and a checkout of the
suites, none of which a normal build has; they are slow; and they cannot
run at the same time as each other, so a per pull request job would be
mostly waiting. Nightly, plus a button to start one by hand, fits what
they are for.

Titan comes from the distribution rather than from source here. The
packaged version trails the protocol modules, but it does build the
suites in the tree today, and a source build would add a quarter of an
hour to every run.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
2026-09-27 09:10:28 -04:00
Graham Roff
ca43efb40c scripts: size_report: Use path caching to improve performance
Cache resolved source paths and use indexed lookups for symbol address
matching and tree construction. This avoids repeated filesystem access,
quadratic symbol scans, and repeated tree traversal. Experimental
results show approximately 50% improvement in performance for large ELF
files.

Assisted-by: Codex::gpt-5.6-sol
Signed-off-by: Graham Roff <grahamr@qti.qualcomm.com>
2026-09-27 09:09:31 -04:00