feat(firmware): complete ADR-061 QEMU testing platform (all 9 layers)

Fix 9 bugs (LFSR bias, MAC filter init, scenario loop, NVS boundary
values), add 7 new files completing Layers 3 (mesh), 4 (GDB), 5
(coverage), 8 (snapshots), 9 (chaos testing), expand CI with fuzz
and NVS validation jobs, update README with full platform overview.

Co-Authored-By: claude-flow <ruv@ruv.net>
This commit is contained in:
ruv
2026-03-14 11:08:59 -04:00
parent ffeaa46bc6
commit fb2d1afb0c
16 changed files with 2413 additions and 47 deletions
+17 -6
View File
@@ -121,8 +121,8 @@ static uint32_t lfsr_next(void)
static float lfsr_float(void)
{
uint32_t r = lfsr_next();
/* Map [0, UINT32_MAX] to [-1.0, +1.0] */
return ((float)(r & 0xFFFF) / 32767.5f) - 1.0f;
/* Map [0, 65535] to [-1.0, +1.0] using 65535/2 = 32767.5 */
return ((float)(r & 0xFFFF) / 32768.0f) - 1.0f;
}
/* ---- Module state ---- */
@@ -402,11 +402,12 @@ static void gen_channel_sweep(uint8_t *iq_buf, uint8_t *channel, int8_t *rssi)
static void gen_mac_filter(uint8_t *iq_buf, uint8_t *channel, int8_t *rssi,
bool *skip_inject)
{
/* Set up the filter MAC to match s_good_mac on first frame. */
if (s_state.frame_count == 0 ||
(s_state.frame_count == s_state.scenario_start_ms)) {
/* Set up the filter MAC to match s_good_mac on first frame of this scenario. */
static bool s_mac_filter_initialized = false;
if (!s_mac_filter_initialized) {
memcpy(g_nvs_config.filter_mac, s_good_mac, 6);
g_nvs_config.filter_mac_set = 1;
s_mac_filter_initialized = true;
ESP_LOGI(TAG, "MAC filter scenario: filter set to %02X:%02X:%02X:%02X:%02X:%02X",
s_good_mac[0], s_good_mac[1], s_good_mac[2],
s_good_mac[3], s_good_mac[4], s_good_mac[5]);
@@ -477,13 +478,17 @@ static void gen_boundary_rssi(uint8_t *iq_buf, uint8_t *channel, int8_t *rssi)
/**
* Advance to the next scenario when running SCENARIO_ALL.
*/
/** Flag: set when all scenarios are done so timer callback exits early. */
static bool s_all_done = false;
static void advance_scenario(void)
{
s_state.all_idx++;
if (s_state.all_idx >= MOCK_SCENARIO_COUNT) {
ESP_LOGI(TAG, "All %d scenarios complete (%lu total frames)",
MOCK_SCENARIO_COUNT, (unsigned long)s_state.frame_count);
s_state.all_idx = 0; /* Loop. */
s_all_done = true;
return; /* Stop generating — timer callback will check s_all_done. */
}
s_state.scenario = s_state.all_idx;
@@ -507,6 +512,11 @@ static void mock_timer_cb(void *arg)
{
(void)arg;
/* All scenarios finished — stop generating. */
if (s_all_done) {
return;
}
/* Check for scenario timeout in SCENARIO_ALL mode. */
if (s_state.scenario == MOCK_SCENARIO_ALL ||
(s_state.all_idx > 0 && s_state.all_idx < MOCK_SCENARIO_COUNT)) {
@@ -610,6 +620,7 @@ esp_err_t mock_csi_init(uint8_t scenario)
s_state.person2_x = 4.0f;
s_state.person2_speed = WALK_SPEED_MS * 0.6f;
s_state.scenario_start_ms = (uint32_t)(esp_timer_get_time() / 1000);
s_all_done = false;
/* Reset LFSR to deterministic seed. */
s_lfsr = 0xDEADBEEF;
@@ -0,0 +1,47 @@
# sdkconfig.coverage -- ESP-IDF sdkconfig overlay for gcov/lcov code coverage
#
# This overlay enables GCC code coverage instrumentation (gcov) and the
# application-level trace (apptrace) channel required to extract .gcda
# files from the target via JTAG/QEMU GDB.
#
# Usage (combine with sdkconfig.defaults as the base):
#
# idf.py -D SDKCONFIG_DEFAULTS="sdkconfig.defaults;sdkconfig.coverage" build
#
# After running the firmware under QEMU, dump coverage data through GDB:
#
# (gdb) mon gcov dump
#
# Then process the .gcda files on the host with lcov/genhtml:
#
# lcov --capture --directory build --output-file coverage.info \
# --gcov-tool xtensa-esp-elf-gcov
# genhtml coverage.info --output-directory coverage_html
# ---------------------------------------------------------------------------
# Compiler: disable optimizations so every source line maps 1:1 to object code
# ---------------------------------------------------------------------------
CONFIG_COMPILER_OPTIMIZATION_NONE=y
# ---------------------------------------------------------------------------
# Application-level trace: enables the gcov data channel over JTAG
# ---------------------------------------------------------------------------
CONFIG_APPTRACE_ENABLE=y
CONFIG_APPTRACE_DEST_JTAG=y
# ---------------------------------------------------------------------------
# CSI mock mode: identical to sdkconfig.qemu so coverage runs use the same
# deterministic mock data path (no real WiFi hardware needed)
# ---------------------------------------------------------------------------
CONFIG_CSI_MOCK_ENABLED=y
CONFIG_CSI_MOCK_SKIP_WIFI_CONNECT=y
CONFIG_CSI_MOCK_SCENARIO=255
CONFIG_CSI_TARGET_IP="10.0.2.2"
CONFIG_CSI_MOCK_SCENARIO_DURATION_MS=5000
CONFIG_CSI_MOCK_LOG_FRAMES=y
# ---------------------------------------------------------------------------
# Logging and display
# ---------------------------------------------------------------------------
CONFIG_LOG_DEFAULT_LEVEL_INFO=y
CONFIG_DISPLAY_ENABLE=n
+21 -1
View File
@@ -1,7 +1,27 @@
# QEMU ESP32-S3 sdkconfig overlay (ADR-061)
#
# Merge with: idf.py -D SDKCONFIG_DEFAULTS="sdkconfig.defaults;sdkconfig.qemu" build
# ---- Mock CSI generator (replaces real WiFi CSI) ----
CONFIG_CSI_MOCK_ENABLED=y
CONFIG_CSI_MOCK_SKIP_WIFI_CONNECT=y
CONFIG_CSI_MOCK_SCENARIO=255
CONFIG_CSI_TARGET_IP="10.0.2.2"
CONFIG_CSI_MOCK_SCENARIO_DURATION_MS=5000
CONFIG_CSI_MOCK_LOG_FRAMES=y
# ---- Network (QEMU SLIRP provides 10.0.2.x) ----
CONFIG_CSI_TARGET_IP="10.0.2.2"
# ---- Logging (verbose for validation) ----
CONFIG_LOG_DEFAULT_LEVEL_INFO=y
# ---- FreeRTOS tuning for QEMU ----
# Increase timer task stack to prevent overflow from mock_csi timer callback
CONFIG_FREERTOS_TIMER_TASK_STACK_DEPTH=4096
# ---- Watchdog (relaxed for emulation — QEMU timing is not cycle-accurate) ----
CONFIG_ESP_TASK_WDT_TIMEOUT_S=30
CONFIG_ESP_INT_WDT_TIMEOUT_MS=800
# ---- Disable hardware-dependent features ----
CONFIG_DISPLAY_ENABLE=n