1 /*
2 * Copyright 2021 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at:
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 */
17
18 #include <FrameTracer/FrameTracer.h>
19 #include <fuzzer/FuzzedDataProvider.h>
20 #include <perfetto/trace/trace.pb.h>
21
22 namespace android::fuzz {
23
24 using namespace google::protobuf;
25
26 constexpr size_t kMaxStringSize = 100;
27 constexpr size_t kMinLayerIds = 1;
28 constexpr size_t kMaxLayerIds = 10;
29 constexpr int32_t kConfigDuration = 500;
30 constexpr int32_t kBufferSize = 1024;
31 constexpr int32_t kTimeOffset = 100000;
32
33 class FrameTracerFuzzer {
34 public:
FrameTracerFuzzer(const uint8_t * data,size_t size)35 FrameTracerFuzzer(const uint8_t* data, size_t size) : mFdp(data, size) {
36 // Fuzzer is single-threaded, so no need to be thread-safe.
37 static bool wasInitialized = false;
38 if (!wasInitialized) {
39 perfetto::TracingInitArgs args;
40 args.backends = perfetto::kInProcessBackend;
41 perfetto::Tracing::Initialize(args);
42 wasInitialized = true;
43 }
44 mFrameTracer = std::make_unique<android::FrameTracer>();
45 }
~FrameTracerFuzzer()46 ~FrameTracerFuzzer() { mFrameTracer.reset(); }
47 void process();
48
49 private:
50 std::unique_ptr<perfetto::TracingSession> getTracingSessionForTest();
51 void traceTimestamp();
52 std::vector<int32_t> generateLayerIds(size_t numLayerIds);
53 void traceTimestamp(std::vector<int32_t> layerIds, size_t numLayerIds);
54 void traceFence(std::vector<int32_t> layerIds, size_t numLayerIds);
55 std::unique_ptr<android::FrameTracer> mFrameTracer = nullptr;
56 FuzzedDataProvider mFdp;
57 android::FenceToFenceTimeMap mFenceFactory;
58 };
59
getTracingSessionForTest()60 std::unique_ptr<perfetto::TracingSession> FrameTracerFuzzer::getTracingSessionForTest() {
61 perfetto::TraceConfig cfg;
62 cfg.set_duration_ms(kConfigDuration);
63 cfg.add_buffers()->set_size_kb(kBufferSize);
64 auto* dsCfg = cfg.add_data_sources()->mutable_config();
65 dsCfg->set_name(android::FrameTracer::kFrameTracerDataSource);
66
67 auto tracingSession = perfetto::Tracing::NewTrace(perfetto::kInProcessBackend);
68 tracingSession->Setup(cfg);
69 return tracingSession;
70 }
71
generateLayerIds(size_t numLayerIds)72 std::vector<int32_t> FrameTracerFuzzer::generateLayerIds(size_t numLayerIds) {
73 std::vector<int32_t> layerIds;
74 for (size_t i = 0; i < numLayerIds; ++i) {
75 layerIds.push_back(mFdp.ConsumeIntegral<int32_t>());
76 }
77 return layerIds;
78 }
79
traceTimestamp(std::vector<int32_t> layerIds,size_t numLayerIds)80 void FrameTracerFuzzer::traceTimestamp(std::vector<int32_t> layerIds, size_t numLayerIds) {
81 int32_t layerId = layerIds.at(mFdp.ConsumeIntegralInRange<size_t>(0, numLayerIds - 1));
82 mFrameTracer->traceTimestamp(layerId, mFdp.ConsumeIntegral<uint64_t>() /*bufferID*/,
83 mFdp.ConsumeIntegral<uint64_t>() /*frameNumber*/,
84 mFdp.ConsumeIntegral<nsecs_t>() /*timestamp*/,
85 android::FrameTracer::FrameEvent::UNSPECIFIED,
86 mFdp.ConsumeIntegral<nsecs_t>() /*duration*/);
87 }
88
traceFence(std::vector<int32_t> layerIds,size_t numLayerIds)89 void FrameTracerFuzzer::traceFence(std::vector<int32_t> layerIds, size_t numLayerIds) {
90 const nsecs_t signalTime = systemTime();
91 const nsecs_t startTime = signalTime + kTimeOffset;
92 auto fence = mFenceFactory.createFenceTimeForTest(android::Fence::NO_FENCE);
93 mFenceFactory.signalAllForTest(android::Fence::NO_FENCE, signalTime);
94 int32_t layerId = layerIds.at(mFdp.ConsumeIntegralInRange<size_t>(0, numLayerIds - 1));
95 mFrameTracer->traceFence(layerId, mFdp.ConsumeIntegral<uint64_t>() /*bufferID*/,
96 mFdp.ConsumeIntegral<uint64_t>() /*frameNumber*/, fence,
97 android::FrameTracer::FrameEvent::ACQUIRE_FENCE, startTime);
98 }
99
process()100 void FrameTracerFuzzer::process() {
101 mFrameTracer->registerDataSource();
102
103 auto tracingSession = getTracingSessionForTest();
104 tracingSession->StartBlocking();
105
106 size_t numLayerIds = mFdp.ConsumeIntegralInRange<size_t>(kMinLayerIds, kMaxLayerIds);
107 std::vector<int32_t> layerIds = generateLayerIds(numLayerIds);
108
109 for (auto it = layerIds.begin(); it != layerIds.end(); ++it) {
110 mFrameTracer->traceNewLayer(*it /*layerId*/,
111 mFdp.ConsumeRandomLengthString(kMaxStringSize) /*layerName*/);
112 }
113
114 traceTimestamp(layerIds, numLayerIds);
115 traceFence(layerIds, numLayerIds);
116
117 mFenceFactory.signalAllForTest(android::Fence::NO_FENCE, systemTime());
118
119 tracingSession->StopBlocking();
120
121 for (auto it = layerIds.begin(); it != layerIds.end(); ++it) {
122 mFrameTracer->onDestroy(*it);
123 }
124 }
125
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)126 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
127 FrameTracerFuzzer frameTracerFuzzer(data, size);
128 frameTracerFuzzer.process();
129 return 0;
130 }
131
132 } // namespace android::fuzz
133