aboutsummaryrefslogtreecommitdiffstats
path: root/pkg/cover/report.go
Commit message (Collapse)AuthorAgeFilesLines
* pkg/cover: reduce params to backend.MakeJiao, Joey2025-04-081-1/+1
|
* pkg: use kernelDir instead of 3 parametersTaras Madan2025-03-271-2/+1
| | | | It allows to reduce parameters count for some functions.
* pkg/cover: reduce prepareFileMap cyclomatic complexityJiao, Joey2025-03-261-28/+39
|
* all: reduce params to MakeReportGeneratorJoey Jiao2025-03-171-5/+4
|
* pkg/manager: export programs + coverage jsonlTaras Madan2025-02-281-2/+2
| | | | | The export is quite big but is generated fast. Every line is a valid json object representing the single program coverage.
* pkg/cover: use frame pointers insteadTaras Madan2025-02-281-1/+1
|
* pkg/cover: rename progPCs to pcToProgsTaras Madan2025-02-141-14/+14
| | | | Reads from this map return Progs, not PCs.
* all: move KernelModule into vminfo packageJoey Jiao2024-07-101-4/+3
|
* all: get pcBase from elf first which can be used for kaslr offset calcJoey Jiao2024-07-031-0/+4
|
* all: always use KernelModule ptr to unify usageJoey Jiao2024-06-171-1/+1
|
* all: use only one KernelModule structJoey Jiao2024-06-171-1/+1
|
* all: adapt all cover and sig to 64bitJoey Jiao2024-05-271-2/+0
| | | | | | | | | | | | | | | | | | Taken some arm64 devices for example: kaslr_offset is diff at bits 12-40, and kernel modules are loaded at 2GB space, so we have `ffffffd342e10000 T _stext` where uppper 32bit is ffffffd3. However, if we check modules range, the 1st module is loaded at 0xffffffd2eeb2a000, while the last module is loaded at 0xffffffd2f42c4000. We can see the upper 32bits are diff for core kernel and modules. If we use current 32bits for covered PC, we will get wrong module address recovered. So we need to move to 64bit cover and signal: - change cover/sig to 64bit to fit for syz-executor change - remove kernel upper base logic as kernel upper base is not a constant when kaslr enabled for core kernel and modules. - remove unused pcBase
* pkg/cover: move KernelModule from pkg/hostDmitry Vyukov2024-05-031-2/+3
| | | | | | In preparation for pkg/host removal. Nothing in pkg/host uses KernelModule, and pkg/cover is effectively the only user of KernelModule.
* pkg/cover, syz-manager, tools/syz-cover: add the ?force=1 URL parameter for ↵Alexander Potapenko2024-04-101-3/+4
| | | | | | | | | | | | coverage When coverage points returned by kcov do not have corresponding coverage callbacks, this may indicate a problem with irrelevant signal being used for fuzzing. Therefore, by default syz-manager reports errors and does not show the coverage report in this case. However, these errors can be annoying when onboarding new platforms, so we let the users disable them by passing the ?force=1 URL parameter.
* pkg/cover: fix jsonl hit count calculationDmitry Vyukov2024-04-091-2/+2
| | | | | | | | | | | prepareFileMap does more work than we need and leads to incorrect hit counts. prepareFileMap produces hit counts per source line (for source reports), but jsonl exports data based on coverage callbacks, not source lines. So if we have 2 callbacks on the same line, we will double count them (both will have hit count 2). If we calculate total percent later based on that data, it will be wrong. Use simpler calculation based on PCs.
* pkg/cover: don't memorize all coverage points twiceDmitry Vyukov2024-04-091-3/+7
| | | | | | | | | | | | | Currently we memorize all coverage points twice: as a slice and as a map. The map also contains __sanitizer_cov_trace_cmp PCs, but I think that's wrong, it should contain only __sanitizer_cov_trace_pc callbacks. We were careful to put as least pressure on the GC as possible by keeping all PCs as a dense allCoverPoints slice and subslicing it in all symbol/compilation unit objects. Don't duplicate coverage points in the map and just use the same slice we store for other purposes.
* pkg/cover: move functions to after they are usedDmitry Vyukov2024-04-091-13/+12
| | | | | This makes code easier to read top-down in the natural order and Go does not require the inverted declaration order like C/C++.
* pkg/cover: add full symbolization for /cover?jsonl=1Taras Madan2024-03-201-21/+25
|
* pkg/cover: export the frames data as jsonlTaras Madan2024-03-191-8/+11
| | | | | | jsonl is new-line-new-json format. It is good for streaming because you can read data line-by-line. This pipeline will stream a lot eventually (x00 megabytes).
* syz-manager/http.go: implement doCoverJSONTaras Madan2024-03-071-2/+4
|
* pkg/cover, syz-manager: introduce the /cover?debug=1 parameterAlexander Potapenko2024-02-131-4/+15
| | | | | | | | | | Debugging coverage point validation warnings may require looking at specific addresses, which are not printed anywhere. Add a URL parameter that can be passed to prepareFileMap() to print a more meaningful error message. Also factor out the error message code from prepareFileMap() to reduce its cyclomatic complexity.
* pkg/mgrconfig, pkg/cover: introduce the android_split_build flagAlexander Potapenko2024-02-011-1/+1
| | | | | | | | | | | | | | | | | | | | | Source files for Pixel devices are split between the common AOSP kernel (path/to/kernel/aosp) and the device-specific drivers residing in a separate dir (path/to/kernel/private/google-modules for Android 14 and path/to/kernel/gs/google-modules for older Android versions). See https://source.android.com/docs/setup/build/building-pixel-kernels for details. Android build system may reference these dirs in various ways, for which syzkaller cannot always understand where it should look for the source. The newly introduced android_split_build flags handles the problem by adding a list of "delimiters" used when normalizing the kernel source paths. If the path contains any of such delimiters, then everything preceding the last delimiter in the path is replaced with the contents of "kernel_src" from the manager config. By default we only support "/aosp/" and "/private/" corresponding to modern Android systems as delimiters.
* pkg/cover: ensure that all PCs returned by kcov have matching callbacksAlexander Potapenko2024-01-291-0/+12
| | | | | | | | | | | | | | | | In the case some modules' addresses are off, certain kernel addresses returned by kcov may not have corresponding coverage callbacks in the .ko files. Keep an additional map in the backend to verify those addresses and report an error if that is the case. Because GCC < 14 may tail-call coverage callbacks, the described check is not performed for binaries which mention GCC in their .comment section. Also adjust text expectations in pkg/cover/report_test.go, so that non-GCC targets check for PCs matching the callbacks. See https://github.com/google/syzkaller/issues/4447 for more details.
* pkg/cover: fix missing frames and export Inline by /rawcoverfilesTaras Madan2024-01-251-9/+0
|
* Revert "pkg/cover: ensure that all PCs returned by kcov have matching callbacks"Alexander Potapenko2024-01-181-15/+0
| | | | | | | This reverts commit 3392690e404b6ba5022825d33259bc2e9e89eb53. x86 bots are unable to generate coverage reports, because they actually have coverage PCs without matching callbacks.
* pkg/cover: ensure that all PCs returned by kcov have matching callbacksAlexander Potapenko2024-01-171-0/+15
| | | | | | | | | | In the case some modules' addresses are off, certain kernel addresses returned by kcov may not have corresponding coverage callbacks in the .ko files. Keep an additional map in the backend to verify those addresses and report an error if that is the case. Also adjust text expectations in pkg/cover/report_test.go, as inexact coverage will result in an error now.
* all: pass cfg to MakeReportGeneratorJoey Jiao2023-07-041-6/+7
| | | | Change-Id: I839fbc94c02da62cadee99a44b4f7c520e35a0dd
* syz-manager: display raw coverageAleksandr Nogikh2022-03-281-10/+13
|
* all: add /modulecover pageJoey Jiao2021-07-141-2/+5
|
* all: add /rawcoverfiles to help debug PC symbolizeJoey Jiao2021-06-241-0/+9
|
* pkg/cover: refactor module discovery interfaceDmitry Vyukov2021-03-181-18/+2
| | | | | | | Make module discovery convert host.KernelModule to backend.Module. Also error if we have modules on non-Linux and make it possible to return errors from module discovery.
* pkg/cover: use symbols to split PCs by moduleDmitry Vyukov2021-03-181-14/+5
| | | | | | We already find symbol for every PC in lazySymbolize. We can just use that to map PCs to modules instead of the additional modules sorting/searching.
* pkg/cover/backend: rename KernelModule to ModuleDmitry Vyukov2021-03-181-2/+2
| | | | | We don't have any other modules. Move definition below Impl, KernelModule is not the most important thing.
* pkg/cover: fix GroupPCsByModuleDmitry Vyukov2021-03-181-12/+4
| | | | | | | | | | | | | Both elf.go and gvisor.go are compiled into the same package, so GroupPCsByModule callback gets installed for gvisor as well. Move all modules-related logic into backend. Splitting by modules is the only modules-related part left in the common code. Move it into backend. This make Modules field unnecessary in the backend.Impl. Also move assignment to frame.Module to symbolize, reduces overall code size.
* pkg/cover: pass modules as []host.KernelModuleDmitry Vyukov2021-03-181-13/+25
| | | | | | | | | | Pass modules as []host.KernelModule to cover.MakeReportGenerator. This avoids make(map) in callers that don't pass modules. Store modules as []*KernelModule. This avoids clumsy assignments to the map to update Path and allows to store modules as *KernelModule rather than by name (we are not scripting, pointer is more flexible and handy representation).
* pkg/mgrconfig: move Subsystem from pkg/coverDmitry Vyukov2021-03-181-4/+5
| | | | | | | | | | | | | | | | | | mgrconfig used to be "leaf" package that can be imported by anything. Recently it started importing pkg/cover for Subsystem definition. It leads to the following import cycle if I try to import pkg/host from pkg/cover: package github.com/google/syzkaller/pkg/bisect imports github.com/google/syzkaller/pkg/build imports github.com/google/syzkaller/pkg/mgrconfig imports github.com/google/syzkaller/pkg/cover imports github.com/google/syzkaller/pkg/host imports github.com/google/syzkaller/pkg/csource imports github.com/google/syzkaller/pkg/mgrconfig: import cycle not allowed Move Subsystem into pkg/mgrconfig itself.
* all: support coverage of kernel modulesJoey Jiao2021-03-181-7/+22
| | | | | | | | | | | | | | | | | | | | | | | | | The PCs returned for dynamic loaded module (DLKM) is not parsed in coverage page, these PCs are dropped. The commit is to use DLKM modules' load address and symbol file to restore the PC and show coverage data of DLKM. Introduced new config module_obj to specify module directories. Example of config: "module_obj": [ "module_path1" "module_path2" ] For linux target, before Manager.Connect run, load addresses are getting from /proc/modules in order to group PCs into modules. And so, if modules are under kernel_obj or module_obj dir, their addresses and paths can be generated automatically. kernel_obj is searched before module_obj dir and the first found ko object is always used. Also note that kaslr needs to be disabled.
* Revert "all: add KernelModule cfg to show DLKM coverage"Dmitry Vyukov2021-03-051-30/+4
| | | | This reverts commit 69a06ca2b532ff4021a43fdead4e2ac1452a44c0.
* all: add KernelModule cfg to show DLKM coverageJoey Jiao2021-03-051-4/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | PC returned for dynamic loaded module (DLKM) is not parsed in coverage page. So the commit is to use DLKM modules' load address to restore the PC and show coverage data of DLKM. As the load address is written in cfg file, so kaslr needs to be disabled. And for linux target, load address is getting from /proc/modules during instance setup. For either manual or auto address setting case, name and path are needed in config kernel_modules, where name is module name on target. path is module unstripped object path on host. addr is decimal value of module load address on target. Example of config: "kernel_modules": [ { "name": "nf_nat", "path": "/usr/src/linux-source/net/netfilter/nf_nat.ko", "addr": 18446744072637911040 } ]
* pkg/cover, syz-manager: show coverage summaryJoey Jiaojg2021-03-021-10/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * pkg/cover, syz-manager: show coverage summary The funccover or cover page is not easy for statistic purpose. So add /cover?type=rawfiles to show coverage based on each file. And /cover?type=table page to show coverage for group of components. If driver_path_map.json exists, /cover?type=table can show component coverage. Format example: { "all": [ "/" ], "audio": [ "/techpack/audio/asoc", "/techpack/audio/dsp", "/techpack/audio/ipc", "/sound/core" ] } If driver_path_map.json not exist, it will show one line summary. * pkg/cover: use subsystem naming * syz-manager: use /subsystemcover and /filecover * pkg/cover: use subsystem from config * pkg/mgrconfig: add kernel_subsystem * pkg/cover, tools/syz-cover: fix make test * all: fix presumit errors * pkg/cover, syz-manager: fix subsystem
* pkg/cover: support compiler frontend coverageDmitry Vyukov2020-12-131-32/+31
| | | | | | | Currently we only support compiler middle/backenend coverage where we can map coverage points to source line. Support better frontend coverage where coverage points map to source code ranges start line:col - end line:col.
* pkg/cover: move cleanPath into backendDmitry Vyukov2020-12-131-29/+2
| | | | | gvisor will need some custom logic there, so make it part of backend.
* syz-manager: use ReportGenerator.RestorePC in RPCServer.NewInputDmitry Vyukov2020-12-131-4/+1
| | | | | This will allow to support gvisor coverage where PCs don't need to be rewound to the previous instruction.
* syz-manager: better encapsulate report generatorDmitry Vyukov2020-12-131-0/+3
| | | | Avoid global variables and implicit dependencies on previous initialization.
* pkg/cover: provide ReportGenerator.RestorePCDmitry Vyukov2020-12-131-0/+5
| | | | | | | Better encapsulate all of this logic instead of exposing raw .text offset and a bunch of functions. Also allows to support gvisor coverage where PCs don't need to be rewound to previous instruction.
* pkg/cover: accept object dir instead of object fileDmitry Vyukov2020-12-131-3/+3
| | | | | | This looks more natural. All users duplicate logic of creating object file path, and then pkg/cover second guesses object dir back.
* pkg/cover: pass VM type for report generatorDmitry Vyukov2020-12-131-2/+2
| | | | | This will be needed for gVisor reports, the target is "linux" but VM type is "gvisor".
* pkg/cover: split into ELF-dependent/independent partsDmitry Vyukov2020-12-131-1026/+102
|
* syz-manager: minor coverage filter cleanupDmitry Vyukov2020-12-091-4/+4
| | | | | | | Refactor coverage filer code to make it more clear what produces and consumes what data. Check that target supports shmem. No other functional changes intended.
* syz-manager/manager.go, executor/executor.cc: support coverage filterKaipeng Zeng2020-12-061-12/+50
|
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 19:52:01 +0000