-
Notifications
You must be signed in to change notification settings - Fork 349
[SKIP SOF-TEST] platform/posix: Port fuzzer to upstream "native_sim" board #9280
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
marc-hb
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the very quick response!
To be on the safe side, did you try the EOF_TEST_PATCH test?
The older native_posix board is being deprecated, use native_sim, which is the future-proof API. Mostly just swap the board target and change the C API names. Note the NATIVE_SIMULATOR_IF decoaration on LLVMFuzzerTestOneInput(): that forces the function to be included in the first-stage zephyr.elf link (otherwise it would be dropped as Zephyr/SOF itself doesn't reference the entry point) and to be visible as a global symbol to the libfuzzer instrumentation layer. Signed-off-by: Andy Ross <andyross@google.com>
Didn't noticed that. I have now, it works fine and definitely blows up when needed. |
|
FYI - fuzzer tests passing in mainline PR testing now https://github.com/thesofproject/sof/actions/runs/9790387872 |
The older native_posix board is being deprecated, use native_sim, which is the future-proof API. In theory this should be as simple as just swapping the board name at the west level, but there are a few changes:
The C API is broadly identical between the two, modulo some prefix renaming.
Unfortunately linkage is more of a hassle, as the fuzzing framework inverts the sense of "entry point" and causes some trouble with the way native_sim does its two-stage link. We have to add some hackery:
Make sure the fuzz entry point doesn't get dropped during the initial zephyr.elf link, as it calls OS/sim layer and not the reverse.
Force it to be a global symbol in the final stage, so it can be seen by the code in libfuzzer that needs to call it (normally all Zephyr-side symbols are forced to be library-private to prevent collisions with the global Linux/glibc namespace environment)