all: move fuzzer to the host

Instead of doing fuzzing in parallel in running VM, make all decisions
in the host syz-manager process.

Instantiate and keep a fuzzer.Fuzzer object in syz-manager and update
the RPC between syz-manager and syz-fuzzer to exchange exact programs to
execute and their resulting signal and coverage.

To optimize the networking traffic, exchange mostly only the difference
between the known max signal and the detected signal.

1 files changed, 23 insertions, 3 deletions

diff --git a/pkg/fuzzer/stats.go b/pkg/fuzzer/stats.go
index 17bc6131c..044febc64 100644
--- a/pkg/fuzzer/stats.go
+++ b/pkg/fuzzer/stats.go
@@ -3,6 +3,8 @@
 
 package fuzzer
 
+import "github.com/google/syzkaller/pkg/corpus"
+
 const (
 	statGenerate       = "exec gen"
 	statFuzz           = "exec fuzz"
@@ -17,10 +19,28 @@ const (
 	statBufferTooSmall = "buffer too small"
 )
 
-func (fuzzer *Fuzzer) GrabStats() map[string]uint64 {
+type Stats struct {
+	CoverStats
+	corpus.Stats
+	Candidates  int
+	RunningJobs int
+	// Let's keep stats in Named as long as the rest of the code does not depend
+	// on their specific values.
+	Named map[string]uint64
+}
+
+func (fuzzer *Fuzzer) Stats() Stats {
+	ret := Stats{
+		CoverStats:  fuzzer.Cover.Stats(),
+		Stats:       fuzzer.Config.Corpus.Stats(),
+		Candidates:  int(fuzzer.queuedCandidates.Load()),
+		RunningJobs: int(fuzzer.runningJobs.Load()),
+		Named:       make(map[string]uint64),
+	}
 	fuzzer.mu.Lock()
 	defer fuzzer.mu.Unlock()
-	ret := fuzzer.stats
-	fuzzer.stats = map[string]uint64{}
+	for k, v := range fuzzer.stats {
+		ret.Named[k] = v
+	}
 	return ret
 }