We'll need a way to pause/resume guest threads at well-defined points, to fuzz threading order and make rare concurrency issues more likely to manifest.
Approaches to evaluate
-
Instrumentation-based: Use compile time instrumentation (e.g. LLVM -fsanitize-coverage=trace-pc-guard) to inject checkpoints at basic-block/edge boundaries. At each guard, the thread consults a control flag and sleeps for a random amount of time. This should work well as it is fine grained but requires custom instrumentation code for each language that test targets are written in.
-
Custom scheduler via sched_ext Implement a BPF scheduler (sched_ext, LWN overview) that decides which guest thread runs. Reference: concurrency-fuzz-scheduler. Works for all test targets but is possibly not as fine-grained as the instrumentation approach.
We'll need a way to pause/resume guest threads at well-defined points, to fuzz threading order and make rare concurrency issues more likely to manifest.
Approaches to evaluate
Instrumentation-based: Use compile time instrumentation (e.g. LLVM -fsanitize-coverage=trace-pc-guard) to inject checkpoints at basic-block/edge boundaries. At each guard, the thread consults a control flag and sleeps for a random amount of time. This should work well as it is fine grained but requires custom instrumentation code for each language that test targets are written in.
Custom scheduler via
sched_extImplement a BPF scheduler (sched_ext, LWN overview) that decides which guest thread runs. Reference: concurrency-fuzz-scheduler. Works for all test targets but is possibly not as fine-grained as the instrumentation approach.