encounter
/
dawn-cmake
mirror of https://github.com/encounter/dawn-cmake.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
dawn-cmake/docs/dawn/fuzzing.md

18 lines
1.9 KiB
Markdown
Raw Normal View History

Add script to generate fuzzer seed corpus from tests This adds a script which runs the end2end_tests, captures a wire trace, and then minimizes the corpus with the fuzzer. Minimizing the corpus requires libfuzzer, so this only works in a Chromium checkout. Unseeded, the fuzzer starts with coverage of about 600 features. Using a seed corpus captured from the tests, the fuzzer quickly increases coverage to about 10,000 features. Change-Id: I8d0db5121745bd5ee4a350cf46fb37cfa434e3dc Bug: dawn:295 Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/14242 Commit-Queue: Austin Eng <enga@chromium.org> Reviewed-by: Kai Ninomiya <kainino@chromium.org>
2019-12-13 01:27:31 +00:00
# Fuzzing Dawn
## `dawn_wire_server_and_frontend_fuzzer`
The `dawn_wire_server_and_frontend_fuzzer` sets up Dawn using the Null backend, and passes inputs to the wire server. This fuzzes the `dawn_wire` deserialization, as well as Dawn's frontend validation.
Reland "fuzzing: Add supportsErrorInjection option to DawnWireServerFuzzer" This is a reland of f58f69f66bacefb0aaf78e91b462b5db97cea391 The whitebox dawn_end2end_tests are updated to link statically against libdawn_native. This is required because the test link against and use libdawn_native as sources. It is an error with MSVC to both import and export symbols from libdawn_native. Original change's description: > fuzzing: Add supportsErrorInjection option to DawnWireServerFuzzer > > This option will be used by backends that support error injection so > that errors can be injected into a "clean" corpus to generate a seed > corpus with good examples of injected error conditions. > > Bug: dawn:295 > Change-Id: I837acdde6dd4274adb56edf8e4307427f8d6333b > Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/14681 > Reviewed-by: Corentin Wallez <cwallez@chromium.org> > Commit-Queue: Austin Eng <enga@chromium.org> Bug: dawn:295 Change-Id: Ifa092d28aa7ac57cfb197aa4daeb8408f8036d4a Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/14820 Reviewed-by: Kai Ninomiya <kainino@chromium.org> Commit-Queue: Austin Eng <enga@chromium.org>
2020-01-06 19:56:17 +00:00
## `dawn_wire_server_and_vulkan_backend_fuzzer`
The `dawn_wire_server_and_vulkan_backend_fuzzer` is like `dawn_wire_server_and_frontend_fuzzer` but it runs using a Vulkan CPU backend such as Swiftshader. This fuzzer supports error injection by using the first bytes of the fuzzing input as a Vulkan call index for which to mock a failure.
Update the wire-based fuzzers to always assume an injected error This also removes the ability for the fuzzer to perform error injection to generate testcases. The preferred method is to use one of the Dawn test binaries to produce the trace directly. Bug: dawn:629 Change-Id: If7295f9e6da5618be8f44e9301aa12dc56fcdfef Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/40301 Reviewed-by: Corentin Wallez <cwallez@chromium.org> Commit-Queue: Austin Eng <enga@chromium.org>
2021-03-23 16:47:50 +00:00
## Automatic Seed Corpus Generation
Add script to generate fuzzer seed corpus from tests This adds a script which runs the end2end_tests, captures a wire trace, and then minimizes the corpus with the fuzzer. Minimizing the corpus requires libfuzzer, so this only works in a Chromium checkout. Unseeded, the fuzzer starts with coverage of about 600 features. Using a seed corpus captured from the tests, the fuzzer quickly increases coverage to about 10,000 features. Change-Id: I8d0db5121745bd5ee4a350cf46fb37cfa434e3dc Bug: dawn:295 Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/14242 Commit-Queue: Austin Eng <enga@chromium.org> Reviewed-by: Kai Ninomiya <kainino@chromium.org>
2019-12-13 01:27:31 +00:00
Using a seed corpus significantly improves the efficiency of fuzzing. Dawn's fuzzers use interesting testcases discovered in previous fuzzing runs to seed future runs. Fuzzing can be further improved by using Dawn tests as a example of API usage which allows the fuzzer to quickly discover and use new API entrypoints and usage patterns.
Update the wire-based fuzzers to always assume an injected error This also removes the ability for the fuzzer to perform error injection to generate testcases. The preferred method is to use one of the Dawn test binaries to produce the trace directly. Bug: dawn:629 Change-Id: If7295f9e6da5618be8f44e9301aa12dc56fcdfef Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/40301 Reviewed-by: Corentin Wallez <cwallez@chromium.org> Commit-Queue: Austin Eng <enga@chromium.org>
2021-03-23 16:47:50 +00:00
Dawn has a CI builder [cron-linux-clang-rel-x64](https://ci.chromium.org/p/dawn/builders/ci/cron-linux-clang-rel-x64) which runs on a periodic schedule. This bot runs the `dawn_end2end_tests` and `dawn_unittests` using the wire and writes out traces of the commands. This can manually be done by running: `<test_binary> --use-wire --wire-trace-dir=tmp_dir`. The output directory will contain one trace for each test, where the traces are prepended with `0xFFFFFFFFFFFFFFFF`. The header is the callsite index at which the error injector should inject an error. If the fuzzer doesn't support error injection it will skip the header. [cron-linux-clang-rel-x64] then hashes the output files to produce unique names and uploads them to the fuzzer corpus directories.
Please see the `dawn.py`[https://source.chromium.org/chromium/chromium/tools/build/+/master:recipes/recipes/dawn.py] recipe for specific details.
Add script to generate fuzzer seed corpus from tests This adds a script which runs the end2end_tests, captures a wire trace, and then minimizes the corpus with the fuzzer. Minimizing the corpus requires libfuzzer, so this only works in a Chromium checkout. Unseeded, the fuzzer starts with coverage of about 600 features. Using a seed corpus captured from the tests, the fuzzer quickly increases coverage to about 10,000 features. Change-Id: I8d0db5121745bd5ee4a350cf46fb37cfa434e3dc Bug: dawn:295 Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/14242 Commit-Queue: Austin Eng <enga@chromium.org> Reviewed-by: Kai Ninomiya <kainino@chromium.org>
2019-12-13 01:27:31 +00:00
Update the wire-based fuzzers to always assume an injected error This also removes the ability for the fuzzer to perform error injection to generate testcases. The preferred method is to use one of the Dawn test binaries to produce the trace directly. Bug: dawn:629 Change-Id: If7295f9e6da5618be8f44e9301aa12dc56fcdfef Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/40301 Reviewed-by: Corentin Wallez <cwallez@chromium.org> Commit-Queue: Austin Eng <enga@chromium.org>
2021-03-23 16:47:50 +00:00
Regenerating the seed corpus keeps it up to date when Dawn's API or wire protocol changes.