Commit Graph

24 Commits

Author SHA1 Message Date
Curtis Malainey 50f17d34e6 fuzz: add coverage build
Fixes coverage introspection

Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
2024-10-30 09:26:08 +00:00
Curtis Malainey 52e944036d fuzz: add support for 64 bit builds
This is needed for MSAN

Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
2024-10-02 14:41:32 +01:00
Curtis Malainey 186251cddc fuzzer: add ubsan support
Adds support for undefined fuzzing

Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
2024-09-11 14:04:01 +03:00
Curtis Malainey f383b0ffab fuzz: add argument to support other sanitizers
Allows for switching out zephyr configs for other sanitizers

Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
2024-09-06 21:27:05 +03:00
Marc Herbert 2a23f3be21 Add new `fuzz_*features.conf` files to add more CONFIG_ when fuzzing
The goal of these new files is to:
1. Fuzz more code
2. Reduce the configuration gap between fuzzed SOF and the real thing.

See the fuzz_features.conf header for more details.

Signed-off-by: Marc Herbert <marc.herbert@intel.com>
2024-09-02 16:48:32 +01:00
Marc Herbert 8a99c58906 fuzz.sh: add -i3 and -i4; shortcuts for -DCONFIG_IPC_MAJOR_$i=y
Only a shortcut for now but allow more IPC version-dependent logic
later.

Signed-off-by: Marc Herbert <marc.herbert@intel.com>
2024-09-02 16:48:32 +01:00
Marc Herbert 577c9ae3e7 fuzz.sh: add new boards/native_sim_libfuzzer.conf
Extract -DCONFIG_* definitions hardcoded inside the script and move them
to a new .conf file where they belong.

This is a first, baby-step towards addressing the more general lack of
.config control described in #9386

Signed-off-by: Marc Herbert <marc.herbert@intel.com>
2024-08-23 13:28:23 +01:00
Marc Herbert cda94e1688 fuzz.sh: replace deprecated OVERLAY_CONFIG with newer EXTRA_CONF_FILE
OVERLAY_CONFIG was deprecated in Zephyr 3.4 commit
https://github.com/zephyrproject-rtos/zephyr/commits/3a345682ba81

Also enhance example and demonstrate the syntax to pass multiple files.

This finishes the work started by commit 6cd34c89a1
("xtensa-build-zephyr.py: use EXTRA_CONF_FILE instead of OVERLAY_CONFIG")

Signed-off-by: Marc Herbert <marc.herbert@intel.com>
2024-08-21 14:25:56 +01:00
Andy Ross 2688f6345a platform/posix: Port fuzzer to upstream "native_sim" board
The older native_posix board is being deprecated, use native_sim,
which is the future-proof API.  Mostly just swap the board target and
change the C API names.

Note the NATIVE_SIMULATOR_IF decoaration on LLVMFuzzerTestOneInput():
that forces the function to be included in the first-stage zephyr.elf
link (otherwise it would be dropped as Zephyr/SOF itself doesn't
reference the entry point) and to be visible as a global symbol to the
libfuzzer instrumentation layer.

Signed-off-by: Andy Ross <andyross@google.com>
2024-07-04 10:34:47 +03:00
Marc Herbert 59bc4e26ba fuzz.sh: fix ZEPHYR_BASE comment
Explain why and when ZEPHYR_BASE is useful. Zero code change.

Signed-off-by: Marc Herbert <marc.herbert@intel.com>
2024-05-09 11:16:51 +03:00
Andy Ross e7f76eec4d platform/posix: Unbreak fuzzer support
Upstream Zephyr moved the LLVM fuzzer entry point out of the arch
layer and made it an app responsibility, so we broke.  Add back the
support here that got removed.

Fixes #9101

Signed-off-by: Andy Ross <andyross@google.com>
2024-05-09 11:13:15 +03:00
Marc Herbert 582c81fab8 fuzz.sh: add -jobs parameter. Switch to built-in -max_total_time.
There was no need to use the external "timeout" command + some
complicated exit code logic, libFuzzer has that feature built-in. Switch
to it and delete a few good line.

Add an option to use the built-in, concurrent -jobs feature which saves
a massive amount of time. It has some quirks so do not enable it by
default.

Decrease verbosity by default.

Add in the help message the magic replay command that saves a ton of time.

Signed-off-by: Marc Herbert <marc.herbert@intel.com>
2024-02-29 13:26:02 +00:00
Marc Herbert 0fee9d9630 scripts/fuzz.sh: add a couple debug -DCONFIG_ options
They shouldn't do much but they can't hurt.

See https://github.com/thesofproject/sof/pull/8632 for more details.

Signed-off-by: Marc Herbert <marc.herbert@intel.com>
2024-02-28 15:39:56 +00:00
Marc Herbert e04289d6a9 scripts/fuzz.sh: add a -p "pristine" flag that deletes build-fuzz/
It's slower but safer when changing some parameters.

Signed-off-by: Marc Herbert <marc.herbert@intel.com>
2024-02-07 12:50:08 +00:00
Marc Herbert de28dd5fe5 Give fuzz.sh a `proper -h` help text
Long overdue.

Signed-off-by: Marc Herbert <marc.herbert@intel.com>
2023-12-19 16:52:33 +00:00
Marc Herbert 03fe9d3149 fuzz.sh: use set -x to make the `west build ...` command visible
Users want to know what exactly failed.

Signed-off-by: Marc Herbert <marc.herbert@intel.com>
2023-12-19 16:52:33 +00:00
Marc Herbert 6458f48471 scripts/fuzz.sh: fix multiple issues with "stub" overlays
Fixes commit deed9a8808 ("scripts: fuzz: add support for build and
overlays")

The main issue was the way fuzz.sh was trying to parse the overlay
file. Drop that and just pass it as is to `west` and `cmake` instead,
they know what to do with it.

Also:

- Fix invalid syntax in stub_build_all_ipc4.conf
- Make fuzz.sh shellcheck-clean again. Always use shellcheck.
- Temporarily disable `CONFIG_COMP_SMART_AMP` in
  stub_build_all_ipc3.conf because `smart_amp.c` does not compile (in
  any configuration)

```
sof/src/audio/smart_amp/smart_amp.c:748:9: error:
   no member named 'in_channels' in 'struct smart_amp_data'
   sad->in_channels = audio_stream_get_channels(&source_buffer->stream);
```

Signed-off-by: Marc Herbert <marc.herbert@intel.com>
2023-10-31 14:23:26 +00:00
Curtis Malainey deed9a8808 scripts: fuzz: add support for build and overlays
Add support to specify an overlay file to use with the fuzz script and
another flag to build without fuzzing

Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
2023-07-26 13:31:36 +01:00
Marc Herbert 5a9dc8a0b5 scripts/fuzz.sh: add -DCONFIG_ZEPHYR_POSIX
Don't rely on some semi-random default value.

The final `zephyr/.config` and binaries are strictly identical.

Signed-off-by: Marc Herbert <marc.herbert@intel.com>
2023-06-13 11:11:14 +03:00
Marc Herbert 1621a95f01 scripts/fuzz.sh: cosmetic move list of CONFIG_s to a bash array
This saves a lot of backslashes and is easier to read. Zero change.

Signed-off-by: Marc Herbert <marc.herbert@intel.com>
2023-06-13 11:11:14 +03:00
Marc Herbert bc0b868ffd fuzz.sh: update comments for IPC4. No functional change.
Update comments for brand new IPC4 support. No functional change.

Signed-off-by: Marc Herbert <marc.herbert@intel.com>
2023-05-11 11:43:07 +03:00
Marc Herbert f41ad4329d scripts/fuzz.sh: add timeout feature and stdout redirection
Also add getopts and a very crude help. Should be enough to get started
in CI.

Signed-off-by: Marc Herbert <marc.herbert@intel.com>
2023-03-24 16:20:23 +00:00
Marc Herbert f09f3ae00b scripts/fuzz.sh: various cosmetic fixes
- Create new setup() function
- Separate export for set -e compatibility
- Don't use the generic `build` directory but a more specific
 `build-fuzz` instead.
- De-hardcode zephyr path thanks to west
- shellcheck clean

Signed-off-by: Marc Herbert <marc.herbert@intel.com>
2023-03-24 16:20:23 +00:00
Andy Ross 3f5c0baba1 scripts: Add fuzz test wrapper
Simple script to explain how fuzz testing works

Signed-off-by: Andy Ross <andyross@google.com>
2023-02-08 11:47:56 +02:00