1# Fuzzers for SurfaceFlinger 2## Table of contents 3+ [SurfaceFlinger](#SurfaceFlinger) 4+ [DisplayHardware](#DisplayHardware) 5+ [Scheduler](#Scheduler) 6+ [Layer](#Layer) 7+ [FrameTracer](#FrameTracer) 8 9# <a name="SurfaceFlinger"></a> Fuzzer for SurfaceFlinger 10 11SurfaceFlinger supports the following data sources: 121. Pixel Formats (parameter name: `defaultCompositionPixelFormat`) 132. Data Spaces (parameter name: `defaultCompositionDataspace`) 143. Rotations (parameter name: `internalDisplayOrientation`) 153. Surface composer tags (parameter name: `onTransact`) 16 17You can find the possible values in the fuzzer's source code. 18 19#### Steps to run 201. Build the fuzzer 21``` 22 $ mm -j$(nproc) surfaceflinger_fuzzer 23``` 242. To run on device 25``` 26 $ adb sync data 27 $ adb shell /data/fuzz/arm64/surfaceflinger_fuzzer/surfaceflinger_fuzzer 28``` 29 30# <a name="DisplayHardware"></a> Fuzzer for DisplayHardware 31 32DisplayHardware supports the following parameters: 331. Hal Capability (parameter name: `hasCapability`) 342. Hal BlendMode (parameter name: `setBlendMode`) 353. Hal Composition (parameter name: `setCompositionType`) 364. Hal Display Capability (parameter name: `hasDisplayCapability`) 375. Composition Types (parameter name: `prepareFrame`) 386. Color Modes (parameter name: `setActiveColorMode`) 397. Render Intents (parameter name: `setActiveColorMode`) 408. Power Modes (parameter name: `setPowerMode`) 419. Content Types (parameter name: `setContentType`) 4210. Data Space (parameter name: `setDataspace`) 4311. Transforms (parameter name: `setLayerTransform`) 44 45You can find the possible values in the fuzzer's source code. 46 47#### Steps to run 481. Build the fuzzer 49``` 50 $ mm -j$(nproc) surfaceflinger_displayhardware_fuzzer 51``` 522. Run on device 53``` 54 $ adb sync data 55 $ adb shell /data/fuzz/arm64/surfaceflinger_displayhardware_fuzzer/surfaceflinger_displayhardware_fuzzer 56``` 57 58# <a name="Scheduler"></a> Fuzzer for Scheduler 59 60Scheduler supports the following parameters: 611. VSync Periods (parameter name: `lowFpsPeriod`) 62 63You can find the possible values in the fuzzer's source code. 64 65#### Steps to run 661. Build the fuzzer 67``` 68 $ mm -j$(nproc) surfaceflinger_scheduler_fuzzer 69``` 702. To run on device 71``` 72 $ adb sync data 73 $ adb shell /data/fuzz/arm64/surfaceflinger_scheduler_fuzzer/surfaceflinger_scheduler_fuzzer 74``` 75 76# <a name="Layer"></a> Fuzzer for Layer 77 78Layer supports the following parameters: 791. Display Connection Types (parameter name: `fakeDisplay`) 802. State Sets (parameter name: `traverseInZOrder`) 813. Disconnect modes (parameter name: `disconnect`) 824. Data Spaces (parameter name: `setDataspace`) 83 84You can find the possible values in the fuzzer's source code. 85 86#### Steps to run 871. Build the fuzzer 88``` 89 $ mm -j$(nproc) surfaceflinger_layer_fuzzer 90``` 912. Run on device 92``` 93 $ adb sync data 94 $ adb shell /data/fuzz/arm64/surfaceflinger_layer_fuzzer/surfaceflinger_layer_fuzzer 95``` 96 97# <a name="FrameTracer"></a> Fuzzer for FrameTracer 98 99#### Steps to run 1001. Build the fuzzer 101``` 102 $ mm -j$(nproc) surfaceflinger_frametracer_fuzzer 103``` 1042. To run on device 105``` 106 $ adb sync data 107 $ adb shell /data/fuzz/arm64/surfaceflinger_frametracer_fuzzer/surfaceflinger_frametracer_fuzzer 108``` 109