Skip to content

add NuttX Kconfig fuzzing integration (ntfc fuzz) - #12

Draft
raiden00pl wants to merge 1 commit into
apache:mainfrom
raiden00pl:feature/fuzzing-integration
Draft

add NuttX Kconfig fuzzing integration (ntfc fuzz)#12
raiden00pl wants to merge 1 commit into
apache:mainfrom
raiden00pl:feature/fuzzing-integration

Conversation

@raiden00pl

Copy link
Copy Markdown
Member

Add a new 'ntfc fuzz' command that fuzzes NuttX Kconfig option subsets and classifies the results.

Features:

  • Fuzzing of NuttX Kconfig options on top of a known-good base config
  • Detection of build breaks (options that no longer compile)
  • Detection of runtime-broken features (options that build but make ostest fail, crash, or hang)
  • Measurement of per-option/per-feature flash and RAM cost
  • Automatic mocking of missing board-supplied constants, so unported code bugs are distinguished from missing board wiring
  • Fuzz-surface selection by subsystem, explicit symbols, or feature groups
  • Combination strategies: one-at-a-time, random (reproducible via seed), pairwise, marginal, exhaustive
  • Automatic minimization of failing option combinations to the smallest failing subset
  • Runs on simulator, QEMU, or real hardware
  • Parallel candidate building/running

It's functional now, but I need to carefully review it before it's ready to merge and I'm not sure when I'll do it.

Add a new 'ntfc fuzz' command that fuzzes NuttX Kconfig option subsets
and classifies the results

Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
@raiden00pl raiden00pl linked an issue Aug 4, 2026 that may be closed by this pull request
Comment thread src/ntfc/cli/main.py
``build`` / ``mem`` need only the fuzz config (it names board + tree).
``ostest`` also needs an NTFC target config via ``--confpath``.
"""
from pathlib import Path

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

too much imports, move imports at the top

Comment thread src/ntfc/cli/main.py
return False


def fuzz_run(ctx: Environment) -> int: # pragma: no cover # noqa: C901

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fix C901

Comment thread src/ntfc/cli/main.py

@pass_environment
def cli_on_close(ctx: Environment) -> bool:
def cli_on_close(ctx: Environment) -> bool: # noqa: C901

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fix C901 if possible

# Kconfig file path (top-relative). Orthogonal to the arch profile (which only
# decides how candidates are built/mocked). Add a line to add a subsystem.

sched: '(?:^|/)sched/'

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

scopes also for apps ?

@@ -0,0 +1,10 @@
config:

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

move to config

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Fuzzing with NTFC

1 participant