test: host_command_fuzz: fuzzing test

Writing fuzzing tests is a little tricky, as clang takes over the main
function. Instead, we start the test main function in a thread, and
have LLVMFuzzerTestOneInput prepare the host command buffer, and
wake the TEST_RUNNER task.

To make fuzzing faster, we only send somehow correctly formed requests,
with a valid checksum and length (this can be disabled with an option).

We also make sure that the emulator does not hibernate, reboot or jump
to a different image when fuzzing is enabled.

BRANCH=none
BUG=chromium:854975
TEST=make buildfuzztests -j
     ASAN_OPTIONS="log_path=stderr" \
         build/host/host_command_fuzz/host_command_fuzz.exe -timeout=5

Change-Id: I27b25e44c405f118dfc1296247479245e15e54b4
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/1107523
Reviewed-by: Manoj Gupta <manojgupta@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Jonathan Metzman <metzman@chromium.org>

1 files changed, 5 insertions, 0 deletions

diff --git a/include/test_util.h b/include/test_util.h
index a1ab956359..c85986b229 100644
--- a/include/test_util.h
+++ b/include/test_util.h
@@ -107,6 +107,9 @@ void test_init(void);
 /* Test entry point */
 void run_test(void);
 
+/* Test entry point for fuzzing tests. */
+int test_fuzz_one_input(const uint8_t *data, unsigned int size);
+
 /* Resets test error count */
 void test_reset(void);
 
@@ -144,8 +147,10 @@ void interrupt_generator_udelay(unsigned us);
 
 #ifdef EMU_BUILD
 void wait_for_task_started(void);
+void wait_for_task_started_nosleep(void);
 #else
 static inline void wait_for_task_started(void) { }
+static inline void wait_for_task_started_nosleep(void) { }
 #endif
 
 uint32_t prng(uint32_t seed);