diff options
Diffstat (limited to 'docs/coverage.md')
| -rw-r--r-- | docs/coverage.md | 35 |
1 files changed, 3 insertions, 32 deletions
diff --git a/docs/coverage.md b/docs/coverage.md index 08730ea4a..e19affc39 100644 --- a/docs/coverage.md +++ b/docs/coverage.md @@ -1,35 +1,6 @@ # Coverage -Syzkaller uses [kcov](https://www.kernel.org/doc/html/latest/dev-tools/kcov.html) to collect coverage from the kernel. kcov exports the address of each executed basic block, and syzkaller runtime uses tools from `binutils` (`objdump`, `nm`, `addr2line` and `readelf`) to map these addresses to lines and functions in the source code. - -## Binutils - -Note that if you are fuzzing in cross-arch environment you need to provide correct `binutils` cross-tools to syzkaller before starting `syz-manager`: - -``` bash -mkdir -p ~/bin/mips64le -ln -s `which mips64el-linux-gnuabi64-addr2line` ~/bin/mips64le/addr2line -ln -s `which mips64el-linux-gnuabi64-nm` ~/bin/mips64le/nm -ln -s `which mips64el-linux-gnuabi64-objdump` ~/bin/mips64le/objdump -ln -s `which mips64el-linux-gnuabi64-readelf` ~/bin/mips64le/readelf -export PATH=~/bin/mips64le:$PATH -``` - -### objdump - -`objdump` is used to parse PC value of each call to `__sanitizer_cov_trace_pc` in the kernel image. These PC values are representing all code that is built into kernel image. PC values exported by kcov are compared against these to determine coverage. - -### nm - -`nm` is used to parse address and size of each function in the kernel image. This information is used to map coverage data to functions. This is needed to find out whether certain functions are called at all. - -### addr2line - -`addr2line` is used for mapping PC values exported by kcov and parsed by `objdump` to source code files and lines. - -### readelf - -`readelf` is used to detect virtual memory offset. Executor truncates PC values into `uint32` before sending them to `syz-manager` and `syz-manager` has to detect the offset. +See [this](linux/coverage.md) for Linux kernel specific coverage information. ## Web Interface @@ -71,13 +42,13 @@ PC values associated to the line are not instrumented or source line doesn't gen ## syz-cover -There is small utility in syzkaller repository to generate coverage report on kcov data. This is available in [syz-cover](/tools/syz-cover) and can be build by: +There is small utility in syzkaller repository to generate coverage report based on raw coverage data. This is available in [syz-cover](/tools/syz-cover) and can be built by: ``` bash GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w" -o ./bin/syz-cover github.com/google/syzkaller/tools/syz-cover ``` -kcov data can be obtained from running `syz-manager` by: +Raw coverage data can be obtained from running `syz-manager` by: ``` bash wget http://localhost:<your syz-manager port>/rawcover |