Skip doc/security/vulnerabilities.rst when checking for undefined Kconfig
symbols as older vulnerabilities can contain references to removed Kconfig
symbols.
Signed-off-by: Henrik Brix Andersen <hebad@vestas.com>
Documentation pages around Kconfig have moved around on a couple of
occasions in the past [1] [2] and current redirects were dysfonctional
(leading /) and incomplete, while an entire set of redirects was also
missing. This notably fixes the "browse latest development version of
this page" link on
https://docs.zephyrproject.org/2.7.5/guides/build/kconfig/tips.html or a
link to the "Kconfig tips" page as found in Kconfiglib's current README
(https://pypi.org/project/kconfiglib/)
[1] commit 5342bc64dd [2] commit
5c88418428Fixes#66701
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
The HEAP_MEM_POOL_ADD_SIZE_ is used as a prefix for matching specific
Kconfig option names, i.e. it's not a real option in itself.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Change the keep-sorted check to handle blocks of code uniformly
indented.
Suggested-by: Benjamin Cabé <benjamin@zephyrproject.org>
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
The sorted check code crashes on binary files. Add a check on file type
and only process text ones.
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
The Kconfig check fails when running the script locally for undefined
symbols if the checkout does not include optional modules (the default
behavior). Add these symbol to the Kconfig undef list.
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
This allows defining a list within two marker (zephyr-keep-sorted-start
and zephyr-keep-sorted-stop), and have the CI validate that the block is
kept sorted every time stuff gets added to it.
This is mainly for Kconfig and CMake include lists so that there's no
ambiguity on where to add new stuff.
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
If in a server multiple users are running compliance then it throws
errors as the filename "Kconfig.modules" and "Kconfig.dts" is owned by
someone else.
Fix this by creating a randomized Kconfig file and delete after use.
Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
Adds a test for the data sharing retention feature of MCUboot
configuration to an application.
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Adds a bootloader configuration interface which allows for a
bootloader (e.g. MCUboot) to set configuration in a shared data
area which is then read by the application.
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Add a check to ensure that every module has a corresponding maintainers
file entry, ensure modules are not added with no recorded point of
contact.
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
This patch adds Kconfig options to select either GNU libgcc or LLVM
compiler-rt. The 'rtlib' flag is provided in a config file, so this
patch introduces 'clang_libgcc.cfg' and 'clang_compiler_rt.cfg' which
enable appropriate library. The file is selected by concatenating
the 'clang_' prefix with library name.
Signed-off-by: Patryk Duda <pdk@semihalf.com>
The check currently only runs if the maintainers file itself is changed,
but that means that the check is going to miss every PR that moves
directory or delete files that can potentially trigger an error.
This check is cheap to run, just run it unconditionally.
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
Adds a guide on how to make out-of-tree MCUmgr function handlers
and groups, with an example showing a test implementation.
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Add a variation of the basic Kconfig check that runs with no modules,
catches symbols that are used in the main repository but are defined
only in modules, which are potentially problematic if a downstream
project is not using the specific module.
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
Some node items in Kconfig can be kconfiglib.MENU or kconfiglib.COMMENT.
Those are integers and thus do not contain a node.item.name field.
Handle those separately to avoid hitting the followig exception:
Traceback (most recent call last):
File "/home/runner/work/zephyr/zephyr/./scripts/ci/check_compliance.py",\
line 1307, in main
n_fails = _main(args)
File "/home/runner/work/zephyr/zephyr/./scripts/ci/check_compliance.py",\
line 1242, in _main
test.run()
File "/home/runner/work/zephyr/zephyr/./scripts/ci/check_compliance.py",\
line 277, in run
self.check_no_redefined_in_defconfig(kconf)
File "/home/runner/work/zephyr/zephyr/./scripts/ci/check_compliance.py",\
line 445, in check_no_redefined_in_defconfig
Kconfig node '{node.item.name}' found with prompt or help in\
{node.filename}.
AttributeError: 'int' object has no attribute 'name'
Seen in #58454.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
Sysbuild now generates a .config.sysbuild config file which specifies
settings controlled by sysbuild.
Any setting specified in this .config will overrule user provided
setting, and a warning will be raised if the sysbuild controlled value
is different from the value specified by the user.
This has the following benefits:
- Allow sysbuild to control any build setting without adjustments to
the existing Kconfig tree
- Allow sysbuild to adjust settings based on knowledge regarding enabled
images / bootloaders.
- Cleanup CMake code, as settings in sysbuild no longer needs to be
propagated using CMake cache variables.
Signed-off-by: Torsten Rasmussen <Torsten.Rasmussen@nordicsemi.no>
This commit adds a new `GitDiffCheck` compliance check that checks the
newly added commits with `git diff --check` and reports them back if an
error is found.
This check is needed for some files (e.g. Kconfig) as they are not checked
by `Kconfig` and `KconfigBasic` checks on every commit in a pull request.
Signed-off-by: Filip Kokosinski <fkokosinski@antmicro.com>
Adds mcuboot Kconfig options to the ignore list as these are
defined in mcuboot but used in documentation and samples which
utilise sysbuild to build mcuboot.
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
This moves CONFIG_LLVM_USE_LD into cmake/toolchain/llvm as this
is a toolchain kconfig. Also make it a choice to allow the use
of LLVM's lld as linker.
Signed-off-by: Daniel Leung <daniel.leung@intel.com>
Adds a Kconfig for MCUboot which is used in the documentation to
the CI Kconfig check allow list.
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
WebP images are smaller for similar resolutions and quality while being
compatible with web browsers and other image processing tools.
For higher resolution images, be sure to limit the display size to make
the rendered pages look reasonable.
This was approved by Benjamin Cabé (@kartben) in this discussion thread:
https://github.com/zephyrproject-rtos/zephyr/pull/55488#issuecomment-1461792751
Signed-off-by: Jason Kridner <jkridner@beagleboard.org>
Change the check_compliance main invocation to pass an explicit argv
list from main to parse_args(). This does not change anything for direct
invocation, but allows wrapping the compliance script and using it as a
library while controlling its behavior by passing the intended flags to
main().
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
Enables running CI checks which will now search for initialisation
of argument parser where abbreviations are not disabled.
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Disables allowing the python argparse library from automatically
shortening command line arguments, this prevents issues whereby
a new command is added and code that wrongly uses the shortened
command of an existing argument which is the same as the new
command being added will silently change script behaviour.
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Support running the compliance check script without writing the output
to any file.
This adds a check for the --output flag to not write to the output file
if the value is empty, and add a second flag for inhibiting the
individual case files.
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
Add a YAMLLint compliance check that uses the yamllint package to report
linting error on YAML files.
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
Add a compliance check that tries to load MAINTAINERS.yml with
get_maintainer.Maintainers() if it's been modified by the CL, and fail
compliance if it fails to be parsed.
Example output:
```
ERROR : Test MaintainersFormat failed:
Error parsing MAINTAINERS.yml: MAINTAINERS.yml: YAML error: while
scanning a simple key
in "MAINTAINERS.yml", line 976, column 1
could not find expected ':'
in "MAINTAINERS.yml", line 977, column 3
```
```
ERROR : Test MaintainersFormat failed:
Error parsing MAINTAINERS.yml: MAINTAINERS.yml: glob pattern
'drivers/regulator' in 'files' in area 'Drivers: Regulators' matches a
directory, but has no trailing '/'
```
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
Change the bindings file filter to check for "dts/bindings/" as a
substring rather than prefix. This makes the check catch files in
subdirectories as well (for sample tests and samples), and makes the
check usable on external projects where the bindings may not live in the
project root.
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
Move the file iteration loops of the bindings compliance check in the
callers, so that if we add more checks we don't have iterate on each one
of them and a check works on a single file.
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
Add a check to validate and limit the size of images in the repository,
setting stricter limit for files in boards/.
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
Git normally only works on files, but can include directories if there's
any submodule in the repository. This is currently checked in
filter_py(), move the check into get_files() so it does not have to be
copied around.
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
DevicetreeBindingsCheck is missing the splitlines() call to process the
get_files() output, hence cycling through each character of the output
rather than each file, which causes the check to never run on anything.
Fix it by moving the splitline call into get_files() itself, since every
caller is going to use it anyway.
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
This commit updates the KconfigCheck to add the Kconfig symbols from
both "config" and "choice" symbol lists to the defined symbol list, as
opposed to the "config" list only, in order to prevent any references
to the choice symbols outside the Kconfig files (e.g. in documentation)
from being reported as undefined.
Signed-off-by: Stephanos Ioannidis <stephanos.ioannidis@nordicsemi.no>
Both get_defined_syms and UNDEF_KCONFIG_WHITELIST are used exclusively
by the Kconfig check, so move them to the class.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
Instead of globally resolving ZEPHYR_BASE, move it to _main() so we can
catch potential exceptions when doing so and for consistency with the
rest of globals, like GIT_TOP. This also includes documenting a new
"<zephyr-base>" path hint for classes.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
The global variable ZEPHYR_BASE is always set in the script, so no need
to check for its existence.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
Some errors are attributable to a specific file, but not a specific line
within that file. Allow for formatted errors that refer to a file but
not a line.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
Many tests invoke `git diff` independently with very similar parameters
to obtain a filtered list of files.
Consolidate those into a new `get_files()` function.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
The workaround for old pytest bug
https://github.com/PyCQA/pylint/issues/2906
is not required anymore after more than 3 years, so remove it.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
There were many instances in the code where f-strings were more
appropriate or fitting, change those to use them.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
As per the current Python documentation, use subprocess.run() since the
other, older methods are not recommended anymore.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
The checkpatch regex matched too greedily, so that descriptions with ":"
would match too much, example:
-:20: ERROR:SPACING: spaces required around that '=' (ctx:VxW)
Would match "SPACING: spaces required around that '=' (ctx" instead of
just "SPACING".
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
Add a compliance check that fails if the diff is adding any binary file
to prevent committing them by mistake.
Only check for added files and explicitly allow image files in doc/ and
boards/.
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
Check names must not contain spaces, since they are passed via `-m` in
the command-line.
Also update .gitignore and compliance.yml.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
Add `DevicetreeBindingsCheck` and `required_false_check()`, which
checks to make sure that no new Devicetree bindings add the
redundant `required: false` property.
Signed-off-by: Chris Friedt <cfriedt@meta.com>
Parse the output generated by pylint and store it as FmtdFailure
instances, so that they can be annotated later.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
The current recommended API call for subprocess instantiation is run(),
so replace the low-level Popen and communicate() with it.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
Format the JUnit failure according to the standard:
https://www.ibm.com/docs/en/developer-for-zos/14.2?topic=formats-junit-xml-format
This also includes a new FmtdFailure class, which will be used in
subsequent commits to implement GitHub-compatible annotations. A list of
FmtdFailure instances is kept in the ComplianceTest instance because
the TestCase instance cannot restore classes derived from Result that
the junitparser module doesn't know about.
Use the new function to format checkpatch errors.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
KconfigBasic should not be inheriting from both KconfigCheck and
ComplianceTest. This was a workaround to find all inheritors of
ComplianceTest, so fix the inheritors search instead.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
Instead of arbitrarily storing the string provided by the caller in
either the message attribute or the element text, let the reporter
choose instead.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
Instead of accumulating failure information in a single Result instance,
located at index 0, generate one Result sub-class instance per
failure/error/skip as it is intended in the original library.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
The junitparser Python module now comes with a setter and getter for
Result.text, use them instead of peeking into the underlying XML.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
This sample is intended to show users how they can create a sample which
has dedicated configuration files for extra images included in a build.
MCUboot is used as example on how its default can be adjusted and
MCUboot itself automatically be included in the build when using
sysbuild.
Signed-off-by: Torsten Rasmussen <Torsten.Rasmussen@nordicsemi.no>
Application log level is not detected correctly as the option is defined
using a template, so it can't be grepped.
Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
Add specialized tests that execute another test indirectly and ensure
that the results report errors correctly. See the README.rst file
provided with this commit for details.
Signed-off-by: Yuval Peress <peress@google.com>
There were a bunch of old command-line arguments that haven't been used
in a while, remove them.
Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
Tweak check_compliance.py to allow user to run it w/o having
ZEPHYR_BASE set. This is similar to what we do for twister.
Signed-off-by: Kumar Gala <galak@kernel.org>
This is this initial sysbuild guide on what sysbuild is and how to build
a sample using sysbuild.
It provides an architectural overview of sysbuild.
Descriptions on how to use `west build` or `cmake` + `ninja` to build
projects with the sysbuild infrastructure.
Flashing is described through the use of `west flash`.
Extending sysbuild with additional Zephyr based applications are
described, and reference to CMake documentation for including non-Zephyr
based applications are provided.
Signed-off-by: Torsten Rasmussen <Torsten.Rasmussen@nordicsemi.no>
Signed-off-by: Martí Bolívar <marti.bolivar@nordicsemi.no>
There is a breaking change in Junitparser 'TestCase.result' between
v1.x and v2.x.
Update check_compliance.py minimally to take into account this change.
This avoids relying on an outdated package.
Signed-off-by: Henri Xavier <datacomos@huawei.com>
This commit fixes the broken links to the Contribution Guidelines in
the Compliance Check script.
Signed-off-by: Stephanos Ioannidis <root@stephanos.io>
Adding LOG_BACKEND_MOCK_OUTPUT_DEFAULT &
LOG_BACKEND_MOCK_OUTPUT_SYST to UNDEF_KCONFIG_WHITELIST as Kconfig
options generated by a template under testcases are not
identified by Compliance check by default.
Signed-off-by: Aastha Grover <aastha.grover@intel.com>
This reverts commit e61c534e52, which
enabled commit message checking via the checkpatch script.
The checkpatch commit message checking is currently causing more
problems that it fixes, for example:
1. the rules that are supposed to be specific to the "header" (commit
message) are being applied to the diffs.
2. there are some rules that do not fully make sense for the Zephyr
and the way we have been doing things.
Note that we currently have the 'gitlint' checking the commit messages,
so reverting this feature does not completely take away the commit
message checking in the CI.
If we are to ever re-introduce this feature, all of the aforementioned
issues need to be addressed, and the effects and ramifications of
enabling this feature must be thoroughly analysed.
Signed-off-by: Stephanos Ioannidis <root@stephanos.io>
Change CheckPatch() compliance test to call checkpatch.pl directly
rather than through git diff. This has the advantage of including the
commit message in what is being checked, which is useful to catch stuff
like spurious Gerrit commit ids.
The --mailback does not seem to work correctly in this mode, but since
the output is filtered by checking the command exit code anyway, that
option is redundant, so drop that as well.
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
Kconfig symbols must not be defined in Kconfig.defconfig.* files. Such
files are meant to change the default value of certain options.
Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
Fixes: #38463
With 6be1b2af9b then Zephyr shields and
soc Kconfig are always sourced from Kconfig directly.
However, check_compliance.py generates Kconfig files for sourcing the
same files thus sourcing the same files twice.
The end result is a lot of Kconfig warnings as described in #38463.
Removing the generated Kconfig files as this is no longer needed after
6be1b2af9b has been introduced.
Signed-off-by: Torsten Rasmussen <Torsten.Rasmussen@nordicsemi.no>
New docs for cavs_v25 describe building a Linux kernel for a
Chromebook and need to talk about these kconfigs.
Signed-off-by: Andy Ross <andrew.j.ross@intel.com>
Support for ARM Compiler C library.
This commit add support for the ARM Compiler C libary in:
- Kconfig
- libc/armstdc
A new Kconfig symbol is added to allow a toolchain to specify if they
support linking with the minimal C library.
Also the CMake variable `TOOLCHAIN_HAS_NEWLIB` is exported to Kconfig
so that CONFIG_NEWLIB_LIBS can only be enabled if the toolchain has
newlib.
The armclang toolchain selects the CMake scatter file generator and
disables support for the LD linker template which is not supported by
armlink.
For the ARM Compiler C library, a corresponding lib/libc/armstc/ folder
with a minimal implementation to work with the ARM Compiler C library
is added.
Signed-off-by: Torsten Rasmussen <Torsten.Rasmussen@nordicsemi.no>
The filter_py() function is handed a bunch of file names and is
expected to give back just the python files.
Its input is the output from a 'git diff' command which normally when
used in the vanilla zephyr repository just prints regular files.
In situations where we're checking compliance on a repository with
submodules, however, filter_py() can be given directories in the
'fnames' list from the git output.
In the interests of being defensive and sharing infrastructure, just
handle this case in filter_py().
Signed-off-by: Martí Bolívar <marti.bolivar@nordicsemi.no>
