test

.github/test-spec.yml

@@ -0,0 +1,115 @@
+# This is the Jenkins ci variant of the .github/labler.yaml
+"CI-iot-zephyr-lwm2m-test":
+  - "drivers/console/**/*"
+  - "drivers/flash/**/*"
+  - "subsys/dfu/boot/**/*"
+  - "subsys/net/ip/**/*"
+  - "subsys/net/lib/http/**/*"
+  - "subsys/net/lib/lwm2m//**/*"
+  - "subsys/net/**/*"
+
+"CI-iot-samples-test":
+  - "boards/arm/nrf9160dk_nrf9160/**/*"
+  - "dts/arm/nordic/nrf9160*"
+  - "include/net/**/*"
+  - "subsys/net/lib/**/*"
+
+"CI-iot-libraries-test":
+  - "boards/arm/nrf9160dk_nrf9160/**/*"
+  - "dts/arm/nordic/nrf9160*"
+  - "include/net/socket_ncs.h"
+  - "subsys/testsuite/ztest/**/*"
+
+"CI-lwm2m-test":
+  - "**/*"
+
+"CI-boot-dfu-test":
+  - "subsys/mgmt/mcumgr/**/*"
+  - "subsys/dfu/**/*"
+  - "include/mgmt/mcumgr/**/*"
+  - "include/dfu/**/*"
+  - "samples/subsys/mgmt/mcumgr/smp_svr/**/*"
+
+"CI-tfm-test":
+  - "**/*"
+
+"CI-ble-test":
+  - "**/*"
+
+"CI-mesh-test":
+  - "subsys/bluetooth/mesh/**/*"
+  - "include/bluetooth/mesh/**/*"
+  - "samples/bluetooth/mesh/**/*"
+  - "samples/bluetooth/mesh_demo/**/*"
+  - "samples/bluetooth/mesh_provisioner/**/*"
+  - "tests/bluetooth/mesh/**/*"
+  - "tests/bluetooth/mesh_shell/**/*"
+
+"CI-zigbee-test":
+  - "subsys/mgmt/mcumgr/**/*"
+  - "subsys/dfu/**/*"
+  - "include/mgmt/mcumgr/**/*"
+  - "include/dfu/**/*"
+
+"CI-thingy91-test":
+  - "**/*"
+
+"CI-desktop-test":
+  - "**/*"
+
+"CI-crypto-test":
+  - "**/*"
+
+"CI-rs-test":
+  - "**/*"
+
+"CI-homekit-test":
+  - "include/dfu/**/*"
+  - "include/mgmt/mcumgr/**/*"
+  - "soc/arm/nordic_nrf/**/*"
+  - "subsys/dfu/**/*"
+  - "subsys/settings/**/*"
+  - "subsys/net/lib/openthread/**/*"
+  - "subsys/mgmt/mcumgr/**/*"
+  - "samples/hci_rpmsg/**/*"
+  - "samples/subsys/mgmt/mcumgr/smp_svr/**/*"
+  - any:
+    - "subsys/bluetooth/**/*"
+    - "!subsys/bluetooth/mesh/**/*"
+
+"CI-thread-test":
+  - "**/*"
+
+"CI-nfc-test":
+  - "**/*"
+
+"CI-matter-test":
+  - "**/*"
+
+"CI-find-my-test":
+  - "**/*"
+
+"CI-gazell-test":
+  - "**/*"
+
+"CI-rpc-test":
+  - "**/*"
+
+"CI-modemshell-test":
+  - "include/net/**/*"
+  - "include/posix/**/*"
+  - "include/shell/**/*"
+  - "drivers/net/**/*"
+  - "drivers/serial/**/*"
+  - "drivers/wifi/**/*"
+  - "subsys/shell/**/*"
+  - "subsys/net/**/*"
+  - "subsys/settings/**/*"
+
+"CI-positioning-test":
+  - "include/net/**/*"
+  - "include/posix/**/*"
+  - "drivers/net/**/*"
+  - "drivers/wifi/**/*"
+  - "subsys/net/**/*"
+  - "subsys/settings/**/*"

.github/workflows/clang.yaml

@@ -8,7 +8,7 @@ concurrency:
 
 jobs:
   clang-build:
-    runs-on: zephyr-runner-linux-x64-4xlarge
+    runs-on: ubuntu-latest
     container:
       image: ghcr.io/zephyrproject-rtos/ci:v0.24.5
       options: '--entrypoint /bin/bash'
@@ -18,11 +18,13 @@ jobs:
       fail-fast: false
       matrix:
         platform: ["native_posix"]
+        subset: [1, 2, 3, 4, 5]
     env:
       ZEPHYR_SDK_INSTALL_DIR: /opt/toolchains/zephyr-sdk-0.15.1
       LLVM_TOOLCHAIN_PATH: /usr/lib/llvm-15
       COMMIT_RANGE: ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}
       BASE_REF: ${{ github.base_ref }}
+      MATRIX_SIZE: 5
     outputs:
       report_needed: ${{ steps.twister.outputs.report_needed }}
     steps:
@@ -83,7 +85,7 @@ jobs:
         id: cache-ccache
         uses: zephyrproject-rtos/action-s3-cache@v1
         with:
-          key: ${{ steps.ccache_cache_timestamp.outputs.repo }}-${{ github.ref_name }}-clang-${{ matrix.platform }}-ccache
+          key: ${{ steps.ccache_cache_timestamp.outputs.repo }}-${{ github.ref_name }}-clang-${{ matrix.subset }}-ccache
           path: /github/home/.ccache
           aws-s3-bucket: ccache.zephyrproject.org
           aws-access-key-id: ${{ secrets.CCACHE_S3_ACCESS_KEY_ID }}
@@ -95,6 +97,16 @@ jobs:
           test -d github/home/.ccache && rm -rf /github/home/.ccache && mv github/home/.ccache /github/home/.ccache
           ccache -M 10G -s
 
+      - name: Build test plan with Twister
+        id: twister_test_plan
+        run: |
+          export ZEPHYR_BASE=${PWD}
+          export ZEPHYR_TOOLCHAIN_VARIANT=llvm
+
+          # check if we need to run a full twister or not based on files changed
+          python3 ./scripts/ci/test_plan.py -p native_posix -c origin/${BASE_REF}..
+
+
       - name: Run Tests with Twister
         id: twister
         run: |
@@ -108,7 +120,7 @@ jobs:
           if [ -s testplan.json ]; then
             echo "report_needed=1" >> $GITHUB_OUTPUT
             # Full twister but with options based on changes
-            ./scripts/twister --force-color --inline-logs -M -N -v --load-tests testplan.json --retry-failed 2
+            ./scripts/twister --inline-logs -M -N -v --load-tests testplan.json --retry-failed 2 --subset ${{matrix.subset}}/${MATRIX_SIZE}
           else
             # if nothing is run, skip reporting step
             echo "report_needed=0" >> $GITHUB_OUTPUT
@@ -122,7 +134,7 @@ jobs:
         if: always() && steps.twister.outputs.report_needed != 0
         uses: actions/upload-artifact@v3
         with:
-          name: Unit Test Results (Subset ${{ matrix.platform }})
+          name: Unit Test Results (Subset ${{ matrix.subset }})
           path: twister-out/twister.xml
 
   clang-build-results:

.github/workflows/compliance.yml

@@ -53,6 +53,8 @@ jobs:
         git config --global user.email "[email protected]"
         git config --global user.name "Your Name"
         git remote -v
+        # Sauce tag checks before rebasing
+        git log --oneline --first-parent origin/${BASE_REF}..HEAD | grep -E -v "\[nrf (mergeup|fromtree|fromlist|noup)\][ ]" && { echo 'Sauce tag missing or invalid, format is "[nrf <sauce-tag>] <shortlog>"'; exit 1; }
         git rebase origin/${BASE_REF}
         # debug
         git log  --pretty=oneline | head -n 10
@@ -69,7 +71,7 @@ jobs:
         # debug
         ls -la
         git log  --pretty=oneline | head -n 10
-        ./scripts/ci/check_compliance.py -m Devicetree -m Gitlint -m Identity -m Nits -m pylint -m checkpatch -m Kconfig -c origin/${BASE_REF}..
+        ./scripts/ci/check_compliance.py -m Devicetree -m Gitlint -m Identity -m Nits -m pylint -m checkpatch -m KconfigBasic -c origin/${BASE_REF}..
 
     - name: upload-results
       uses: actions/upload-artifact@v3

.gitlint

@@ -16,7 +16,7 @@ debug = false
 extra-path=scripts/gitlint
 
 [title-max-length-no-revert]
-line-length=75
+line-length=120
 
 [body-min-line-count]
 min-line-count=1
@@ -42,7 +42,7 @@ words=wip
 
 [max-line-length-with-exceptions]
 # B1 = body-max-line-length
-line-length=75
+line-length=120
 
 [body-min-length]
 min-length=3

CODEOWNERS

@@ -14,6 +14,7 @@
 # *                                        @galak @nashif
 
 /.github/				  @nashif @stephanosio
+/.github/test-spec.yml                    @nrfconnect/ncs-test-leads
 /.github/workflows/                       @galak @nashif
 /MAINTAINERS.yml                          @MaureenHelm
 /arch/arc/                                @abrodkin @ruuddw @evgeniy-paltsev

Jenkinsfile

@@ -0,0 +1,5 @@
+@Library("CI_LIB") _
+
+def pipeline = new ncs.sdk_zephyr.Main()
+
+pipeline.run(JOB_NAME)

Kconfig.zephyr

@@ -125,9 +125,7 @@ config FLASH_LOAD_SIZE
 endif # HAS_FLASH_LOAD_OFFSET
 
 config ROM_START_OFFSET
-	hex
-	prompt "ROM start offset" if !BOOTLOADER_MCUBOOT
-	default 0x200 if BOOTLOADER_MCUBOOT
+	hex "ROM start offset"
 	default 0
 	help
 	  If the application is built for chain-loading by a bootloader this

arch/Kconfig

@@ -785,6 +785,7 @@ menu "Floating Point Options"
 config FPU
 	bool "Floating point unit (FPU)"
 	depends on CPU_HAS_FPU
+	depends on !IS_SPM
 	help
 	  This option enables the hardware Floating Point Unit (FPU), in order to
 	  support using the floating point registers and instructions.

boards/arm/circuitdojo_feather_nrf9160/Kconfig.defconfig

@@ -9,6 +9,21 @@ if BOARD_CIRCUITDOJO_FEATHER_NRF9160 || BOARD_CIRCUITDOJO_FEATHER_NRF9160_NS
 config BOARD
 	default "circuitdojo_feather_nrf9160"
 
+# By default, if we build for a Non-Secure version of the board,
+# enable building with TF-M as the Secure Execution Environment.
+config BUILD_WITH_TFM
+	default y if BOARD_CIRCUITDOJO_FEATHER_NRF9160_NS
+
+if BUILD_WITH_TFM
+
+# By default, if we build with TF-M, instruct build system to
+# flash the combined TF-M (Secure) & Zephyr (Non Secure) image
+config TFM_FLASH_MERGED_BINARY
+	bool
+	default y
+
+endif # BUILD_WITH_TFM
+
 # For the secure version of the board the firmware is linked at the beginning
 # of the flash, or into the code-partition defined in DT if it is intended to
 # be loaded by MCUboot. If the secure firmware is to be combined with a non-

boards/arm/nrf5340dk_nrf5340/nrf5340_cpuapp_common.dts

@@ -14,6 +14,7 @@
 		zephyr,bt-mon-uart = &uart0;
 		zephyr,bt-c2h-uart = &uart0;
 		zephyr,bt-hci-rpmsg-ipc = &ipc0;
+		zephyr,ieee802154 = &ieee802154;
 	};
 
 	leds {

boards/arm/sparkfun_thing_plus_nrf9160/Kconfig.defconfig

@@ -9,6 +9,21 @@ if BOARD_SPARKFUN_THING_PLUS_NRF9160 || BOARD_SPARKFUN_THING_PLUS_NRF9160_NS
 config BOARD
 	default "sparkfun_thing_plus_nrf9160"
 
+# By default, if we build for a Non-Secure version of the board,
+# enable building with TF-M as the Secure Execution Environment.
+config BUILD_WITH_TFM
+	default y if BOARD_SPARKFUN_THING_PLUS_NRF9160_NS
+
+if BUILD_WITH_TFM
+
+# By default, if we build with TF-M, instruct build system to
+# flash the combined TF-M (Secure) & Zephyr (Non Secure) image
+config TFM_FLASH_MERGED_BINARY
+	bool
+	default y
+
+endif # BUILD_WITH_TFM
+
 # For the secure version of the board the firmware is linked at the beginning
 # of the flash, or into the code-partition defined in DT if it is intended to
 # be loaded by MCUboot. If the secure firmware is to be combined with a non-

boards/arm/thingy53_nrf5340/Kconfig.defconfig

@@ -8,6 +8,21 @@ if BOARD_THINGY53_NRF5340_CPUAPP || BOARD_THINGY53_NRF5340_CPUAPP_NS
 config BOARD
 	default "thingy53_nrf5340_cpuapp"
 
+# By default, if we build for a Non-Secure version of the board,
+# enable building with TF-M as the Secure Execution Environment.
+config BUILD_WITH_TFM
+	default y if BOARD_THINGY53_NRF5340_CPUAPP_NS
+
+if BUILD_WITH_TFM
+
+# By default, if we build with TF-M, instruct build system to
+# flash the combined TF-M (Secure) & Zephyr (Non Secure) image
+config TFM_FLASH_MERGED_BINARY
+	bool
+	default y
+
+endif # BUILD_WITH_TFM
+
 # Code Partition:
 #
 # For the secure version of the board the firmware is linked at the beginning

boards/arm/thingy53_nrf5340/thingy53_nrf5340_common.dts

@@ -13,6 +13,7 @@
 		zephyr,bt-mon-uart = &uart0;
 		zephyr,bt-c2h-uart = &uart0;
 		zephyr,bt-hci-rpmsg-ipc = &ipc0;
+		zephyr,ieee802154 = &ieee802154;
 	};
 
 	buttons {

cmake/modules/kernel.cmake

@@ -241,3 +241,7 @@ if("${CMAKE_EXTRA_GENERATOR}" STREQUAL "Eclipse CDT4")
   include(${ZEPHYR_BASE}/cmake/ide/eclipse_cdt4_generator_amendment.cmake)
   eclipse_cdt4_generator_amendment(1)
 endif()
+
+if(ZEPHYR_NRF_MODULE_DIR)
+  include(${ZEPHYR_NRF_MODULE_DIR}/cmake/partition_manager.cmake)
+endif()

doc/build/kconfig/setting.rst

@@ -7,8 +7,7 @@ The :ref:`menuconfig and guiconfig interfaces <menuconfig>` can be used to test
 out configurations during application development. This page explains how to
 make settings permanent.
 
-All Kconfig options can be searched in the :ref:`Kconfig search page
-<kconfig-search>`.
+All Kconfig options can be searched in the Kconfig search page.
 
 .. note::
 
@@ -115,8 +114,7 @@ Assignments in configuration files are only respected if the dependencies for
 the symbol are satisfied. A warning is printed otherwise. To figure out what
 the dependencies of a symbol are, use one of the :ref:`interactive
 configuration interfaces <menuconfig>` (you can jump directly to a symbol with
-:kbd:`/`), or look up the symbol in the :ref:`Kconfig search page
-<kconfig-search>`.
+:kbd:`/`), or look up the symbol in the Kconfig search page.
 
 
 .. _initial-conf:

doc/connectivity/networking/api/mqtt.rst

@@ -149,6 +149,7 @@ additional configuration information:
    tls_config->sec_tag_list = m_sec_tags;
    tls_config->sec_tag_count = ARRAY_SIZE(m_sec_tags);
    tls_config->hostname = MQTT_BROKER_HOSTNAME;
+   tls_config->set_native_tls = true;
 
 In this sample code, the ``m_sec_tags`` array holds a list of tags, referencing TLS
 credentials that the MQTT library should use for authentication. We do not specify
@@ -161,6 +162,8 @@ Note, that TLS credentials referenced by the ``m_sec_tags`` array must be
 registered in the system first. For more information on how to do that, refer
 to :ref:`secure sockets documentation <secure_sockets_interface>`.
 
+Finally, ``set_native_tls`` can be optionally set to enable native TLS support instead of offloading TLS operations to the modem.
+
 An example of how to use TLS with MQTT is also present in
 :ref:`mqtt-publisher-sample`.
 

doc/develop/application/index.rst

@@ -508,9 +508,8 @@ started.
 
 See :ref:`setting_configuration_values` for detailed documentation on setting
 Kconfig configuration values. The :ref:`initial-conf` section on the same page
-explains how the initial configuration is derived. See :ref:`kconfig-search`
-for a complete list of configuration options.
-See :ref:`hardening` for security information related with Kconfig options.
+explains how the initial configuration is derived. See :ref:`hardening` for
+security information related with Kconfig options.
 
 The other pages in the :ref:`Kconfig section of the manual <kconfig>` are also
 worth going through, especially if you planning to add new configuration