syz-manager: add corpus triage mode

Add corpus triage mode and support it in testbed.
This is useful to benchmark just the triage phase
w/o any subsequent fuzzing. First, fuzzing is more random.
Second, if triage duration is different in different versions,
then they will do different amount of fuzzing in fixed testbed time.

3 files changed, 19 insertions, 10 deletions

diff --git a/tools/syz-testbed/instance.go b/tools/syz-testbed/instance.go
index 2ea3161e3..5ec278944 100644
--- a/tools/syz-testbed/instance.go
+++ b/tools/syz-testbed/instance.go
@@ -118,9 +118,10 @@ func (inst *SyzManagerInstance) Run() error {
 
 	select {
 	case err := <-ret:
-		// Syz-managers are not supposed to stop themselves under normal circumstances.
-		// If one of them did stop, there must have been a very good reason to do so.
-		return fmt.Errorf("[%s] stopped: %w", inst.Name, err)
+		if err != nil {
+			return fmt.Errorf("[%s] stopped: %w", inst.Name, err)
+		}
+		return nil
 	case <-time.After(inst.RunTime):
 		inst.Stop()
 		<-ret
@@ -131,6 +132,7 @@ func (inst *SyzManagerInstance) Run() error {
 type SyzkallerInfo struct {
 	Workdir   string
 	CfgFile   string
+	Mode      string
 	BenchFile string
 }
 
@@ -162,7 +164,8 @@ func SetupSyzkallerInstance(mgrName, folder string, checkout *Checkout) (*Syzkal
 	}, nil
 }
 
-func (t *SyzManagerTarget) newSyzManagerInstance(slotName, uniqName string, checkout *Checkout) (Instance, error) {
+func (t *SyzManagerTarget) newSyzManagerInstance(slotName, uniqName, mode string, checkout *Checkout) (
+	Instance, error) {
 	folder := filepath.Join(checkout.Path, fmt.Sprintf("run-%s", uniqName))
 	common, err := SetupSyzkallerInstance(slotName, folder, checkout)
 	if err != nil {
@@ -178,11 +181,15 @@ func (t *SyzManagerTarget) newSyzManagerInstance(slotName, uniqName string, chec
 	}
 	return &SyzManagerInstance{
 		InstanceCommon: InstanceCommon{
-			Name:            uniqName,
-			LogFile:         filepath.Join(folder, "log.txt"),
-			ExecCommand:     filepath.Join(checkout.Path, "bin", "syz-manager"),
-			ExecCommandArgs: []string{"-config", common.CfgFile, "-bench", common.BenchFile},
-			stopChannel:     make(chan bool, 1),
+			Name:        uniqName,
+			LogFile:     filepath.Join(folder, "log.txt"),
+			ExecCommand: filepath.Join(checkout.Path, "bin", "syz-manager"),
+			ExecCommandArgs: []string{
+				"-config", common.CfgFile,
+				"-mode", mode,
+				"-bench", common.BenchFile,
+			},
+			stopChannel: make(chan bool, 1),
 		},
 		SyzkallerInfo: *common,
 		RunTime:       t.config.RunTime.Duration,
diff --git a/tools/syz-testbed/targets.go b/tools/syz-testbed/targets.go
index ef0b189a4..6ba08e504 100644
--- a/tools/syz-testbed/targets.go
+++ b/tools/syz-testbed/targets.go
@@ -113,7 +113,7 @@ func (t *SyzManagerTarget) NewJob(slotName string, checkouts []*Checkout) (*Chec
 	t.nextInstanceID++
 	t.mu.Unlock()
 	uniqName := fmt.Sprintf("%s-%d", checkout.Name, instanceID)
-	instance, err := t.newSyzManagerInstance(slotName, uniqName, checkout)
+	instance, err := t.newSyzManagerInstance(slotName, uniqName, t.config.ManagerMode, checkout)
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/tools/syz-testbed/testbed.go b/tools/syz-testbed/testbed.go
index c07ac3bc0..52e63b4be 100644
--- a/tools/syz-testbed/testbed.go
+++ b/tools/syz-testbed/testbed.go
@@ -40,6 +40,7 @@ type TestbedConfig struct {
 	Workdir       string           `json:"workdir"`        // instances will be checked out there
 	ReproConfig   ReproTestConfig  `json:"repro_config"`   // syz-repro benchmarking config
 	ManagerConfig json.RawMessage  `json:"manager_config"` // base manager config
+	ManagerMode   string           `json:"manager_mode"`   // manager mode flag
 	Checkouts     []CheckoutConfig `json:"checkouts"`
 }
 
@@ -81,6 +82,7 @@ func main() {
 		ReproConfig: ReproTestConfig{
 			CrashesPerBug: 1,
 		},
+		ManagerMode: "fuzzing",
 	}
 	err := config.LoadFile(*flagConfig, &cfg)
 	if err != nil {