Skip to content

ipc4: helper: unlock module instance verbs on native_sim #11062

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tmleman wants to merge 1 commit into
base: main
Choose a base branch
from
+47 −0
Open

ipc4: helper: unlock module instance verbs on native_sim #11062

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 47 additions & 0 deletions src/ipc/ipc4/helper.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1361,6 +1361,53 @@ __cold const struct comp_driver *ipc4_get_comp_drv(uint32_t module_id)

#ifdef RIMAGE_MANIFEST
desc = (const struct sof_man_fw_desc *)IMR_BOOT_LDR_MANIFEST_BASE;
#elif defined(CONFIG_ARCH_POSIX_LIBFUZZER)

@lyakh lyakh Aug 6, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

helper.c is a rather intensely used file, so cutting a large chunk of code that is only needed for the fuzzer in the middle of a function looks a bit suboptimal to me. Can we make it a separate function and just do

#elif defined(CONFIG_ARCH_POSIX_LIBFUZZER)
    return ipc4_get_fuzzer_drv(...);

here?

@kv2019i kv2019i Aug 6, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this would be better for readability indeed.

/*
* native_sim fuzz builds have no rimage manifest so ipc4_get_comp_drv()
* would always return NULL, making every module instance verb
* (INIT_INSTANCE, CONFIG_GET/SET, LARGE_CONFIG, BIND, UNBIND,
* DELETE_INSTANCE) unreachable from the fuzzer.
*
* Mirror the IPC3 whitebox hack in posix/ipc.c: treat module_id as a
* 1-based index into the runtime comp_driver list. module_id 0 (BaseFW)
* has no comp_driver entry and is handled separately above via
* ipc4_get_drv(); non-zero ids map to registered drivers so the fuzzer
* can create real module instances with valid driver UUIDs.
*/
Comment on lines +1365 to +1376
if (module_id) {
struct comp_driver_list *dlist = comp_drivers_get();
struct list_item *iter;
uint32_t idx = 0;

list_for_item(iter, &dlist->list) {
struct comp_driver_info *inf =
container_of(iter, struct comp_driver_info, list);

/* Only count drivers that can be instantiated —
* skip BaseFW and other query-only entries that
* have no create op.
*/
if (!inf->drv->ops.create)
continue;

/*
* A real signed manifest only lists module-adapter
* modules. The internal gateway drivers (SOF_COMP_HOST,
* SOF_COMP_DAI) are registered for IPC3 but are never
* IPC4 modules: on the IPC4 path they receive no params()
* pass and cannot be configured (e.g. their DMA buffer is
* never allocated). Skip non-module-adapter drivers here
* so the fuzzer's module_id space matches a real manifest
* and cannot map to an unconfigurable component.
*/
if (inf->drv->type != SOF_COMP_MODULE_ADAPTER)
continue;

if (++idx == module_id)
return inf->drv;
}
}

@lgirdwood lgirdwood Aug 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

may be useful to log that fall through if nothing found to assist developers/agents here.

return NULL;
#else
/* Non-rimage platforms have no component facility yet.
* This needs to move to the platform layer.
Expand Down
Loading