var (
	flagConfig = flag.String("config", "", "configuration file")
	flagDebug  = flag.Bool("debug", false, "dump all VM output to console")
	flagBench  = flag.String("bench", "", "write execution statistics into this file periodically")
)

func main() {
	if prog.GitRevision == "" {
		log.Fatalf("bad syz-manager build: build with make, run bin/syz-manager")
	}
	flag.Parse()
	log.EnableLogCaching(1000, 1<<20)           // [1] 开启日志缓存，日志不超过1000行或1^29字节
	cfg, err := mgrconfig.LoadFile(*flagConfig) // [2] 加载 config 文件
	if err != nil {
		log.Fatalf("%v", err)
	}
	RunManager(cfg)
}

func RunManager(cfg *mgrconfig.Config) {
	var vmPool *vm.Pool
	// Type "none" is a special case for debugging/development when manager
	// does not start any VMs, but instead you start them manually
	// and start syz-fuzzer there.
	if cfg.Type != "none" { // 将type指定为none是在调试/开发中用的，这样manager就不会启动VM而是需要手动启动
		var err error
		vmPool, err = vm.Create(cfg, *flagDebug) // [1] 创建 vmPool
		if err != nil {...
		}
	}

	crashdir := filepath.Join(cfg.Workdir, "crashes")
	osutil.MkdirAll(crashdir)

	reporter, err := report.NewReporter(cfg)
	if err != nil {...
	}

	mgr := &Manager{...
	}

	mgr.preloadCorpus()
	mgr.initStats() // Initializes prometheus variables.
	mgr.initHTTP()  // Creates HTTP server.
	mgr.collectUsedFiles()

	// Create RPC server for fuzzers.
	mgr.serv, err = startRPCServer(mgr)
	if err != nil {...
	}

	if cfg.DashboardAddr != "" {...
	}

	go func() { // [2] 新开线程，定期记录VM状态、crash数量等信息
		for lastTime := time.Now(); ; {
			time.Sleep(10 * time.Second)
			now := time.Now()
			diff := now.Sub(lastTime)
			lastTime = now
			mgr.mu.Lock()
			if mgr.firstConnect.IsZero() {
				mgr.mu.Unlock()
				continue
			}
			mgr.fuzzingTime += diff * time.Duration(atomic.LoadUint32(&mgr.numFuzzing))
			executed := mgr.stats.execTotal.get()
			crashes := mgr.stats.crashes.get()
			corpusCover := mgr.stats.corpusCover.get()
			corpusSignal := mgr.stats.corpusSignal.get()
			maxSignal := mgr.stats.maxSignal.get()
			mgr.mu.Unlock()
			numReproducing := atomic.LoadUint32(&mgr.numReproducing)
			numFuzzing := atomic.LoadUint32(&mgr.numFuzzing)

			log.Logf(0, "VMs %v, executed %v, cover %v, signal %v/%v, crashes %v, repro %v",
				numFuzzing, executed, corpusCover, corpusSignal, maxSignal, crashes, numReproducing)
		}
	}()

	if *flagBench != "" { // [3] 如果设置了 bench 参数，还要在指定的文件中记录一些信息
		...
     	mgr.minimizeCorpus() // [4]
        ...
	}

	if mgr.dash != nil {...
	}

	osutil.HandleInterrupts(vm.Shutdown)
	if mgr.vmPool == nil {...
	}
	mgr.vmLoop() // [5] 主要调用 vmLoop()
}

func (mgr *Manager) vmLoop() {
    ...
			canRepro := func() bool { // [2] 判断当前是否有等待复现的crash
			return phase >= phaseTriagedHub && len(reproQueue) != 0 &&
				(int(atomic.LoadUint32(&mgr.numReproducing))+1)*instancesPerRepro <= maxReproVMs
		}

		if shutdown != nil {
			for canRepro() { // [3] 可以复现且有剩余的 instances, 则复现crash
				vmIndexes := instances.Take(instancesPerRepro) // [3-1] 取 instancesPerRepro 个 (默认4) VM, 对crash进行复现
				if vmIndexes == nil {
					break
				}
				last := len(reproQueue) - 1
				crash := reproQueue[last]
				reproQueue[last] = nil
				reproQueue = reproQueue[:last]
				atomic.AddUint32(&mgr.numReproducing, 1)
				log.Logf(1, "loop: starting repro of '%v' on instances %+v", crash.Title, vmIndexes)
				go func() {
					reproDone <- mgr.runRepro(crash, vmIndexes, instances.Put) // [3-2] crash 复现 runRepro() -> repro.Run() -> ctx.repro() !!!
				}()
			}
			for !canRepro() { // [4] 没有可复现的但是有剩余的 instances, 则进行fuzz
				idx := instances.TakeOne() // [4-1] 取 1 个 VM, 运行新的实例
				if idx == nil {
					break
				}
				log.Logf(1, "loop: starting instance %v", *idx)
				go func() {
					crash, err := mgr.runInstance(*idx) // [4-2] 启动fuzz, 监控信息并返回Report对象 runInstance() -> runInstanceInner() -> FuzzerCmd() & MonitorExecution()  !!!
					runDone <- &RunResult{*idx, crash, err}
				}()
			}
		}
    ...
}

// pkg/repro/repro.go: (*context).repro()
func (ctx *context) repro(entries []*prog.LogEntry, crashStart int) (*Result, error) {
    ...
	res, err := ctx.extractProg(entries) // [2] 提取出触发 crash 的程序  !!!
	...
	res, err = ctx.minimizeProg(res) // [3] 若成功复现, 则调用prog.Minimize(), 简化所有的调用和参数 !!!
	...
	// Try extracting C repro without simplifying options first.
	res, err = ctx.extractC(res) // [4] 生成C代码，编译成二进制文件，执行并检查是否crash，若crash则赋值 res.CRepro = crashed !!!
	...
	// Simplify options and try extracting C repro.
	if !res.CRepro {
		res, err = ctx.simplifyProg(res) // [5] !!! 进一步简化。在 repro.go 中定义了 progSimplifies 数组作为简化规则，依次使用每一条规则后，如果crash还能被触发, 再调用 extractC(res) 尝试提取 C repro
		...
	}
	// Simplify C related options.
	if res.CRepro {
		res, err = ctx.simplifyC(res) // [6] 对提取出的C程序进行简化。 跟上面的ctx.simplifyProg(res)差不多，就是规则使用了cSimplifies数组。[5][6] 简化的是复现crash时设置的一些选项，比如线程、并发、沙盒等等。
		...
	}
	return res, nil
}

func Minimize(p0 *Prog, callIndex0 int, crash bool, pred0 func(*Prog, int) bool) (*Prog, int) {
	pred := func(p *Prog, callIndex int) bool {
		p.sanitizeFix() // [1] 有些系统调用需要做一些特殊的处理 !!!
		p.debugValidate()
		return pred0(p, callIndex)
	}
	...
	// Try to remove all calls except the last one one-by-one.
	p0, callIndex0 = removeCalls(p0, callIndex0, crash, pred) // [2] 尝试逐个移除系统调用

	// Try to reset all call props to their default values.
	p0 = resetCallProps(p0, callIndex0, pred)

	// Try to minimize individual calls.
	for i := 0; i < len(p0.Calls); i++ { // [3] 去除系统调用的无关参数
		ctx := &minimizeArgsCtx{
			target:     p0.Target,
			p0:         &p0,
			callIndex0: callIndex0,
			crash:      crash,
			pred:       pred,
			triedPaths: make(map[string]bool),
		}
	again:
		ctx.p = p0.Clone()
		ctx.call = ctx.p.Calls[i]
		for j, field := range ctx.call.Meta.Args {
			if ctx.do(ctx.call.Args[j], field.Name, "") { // [4] 在do函数中，根据不同的参数类型调用不同的minimize函数 !!!
				goto again
			}
		}
		p0 = minimizeCallProps(p0, i, callIndex0, pred)
	}
	...
	return p0, callIndex0
}

func (mgr *Manager) runInstanceInner(index int, instanceName string) (*report.Report, []byte, error) {
    ...
	fuzzerBin, err := inst.Copy(mgr.cfg.FuzzerBin) // [1] 将 syz-fuzzer 复制到VM中
	if err != nil {
		return nil, nil, fmt.Errorf("failed to copy binary: %v", err)
	}

	// If ExecutorBin is provided, it means that syz-executor is already in the image,
	// so no need to copy it.
	executorBin := mgr.sysTarget.ExecutorBin
	if executorBin == "" {
		executorBin, err = inst.Copy(mgr.cfg.ExecutorBin) // [2] 将 syz-executor 复制到VM中
		...
	}
    ...
	// Run the fuzzer binary.
	start := time.Now()
	atomic.AddUint32(&mgr.numFuzzing, 1)
	defer atomic.AddUint32(&mgr.numFuzzing, ^uint32(0))

	args := &instance.FuzzerCmdArgs{...
	}
	cmd := instance.FuzzerCmd(args) // [3] 调用 FuzzerCmd() 通过ssh执行 syz-fuzzer   !!!
	outc, errc, err := inst.Run(mgr.cfg.Timeouts.VMRunningTime, mgr.vmStop, cmd)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to run fuzzer: %v", err)
	}

	var vmInfo []byte
	rep := inst.MonitorExecution(outc, errc, mgr.reporter, vm.ExitTimeout) // [4] 监控, 检测输出中的内核oops信息、丢失连接、挂起等等。
	...
	return rep, vmInfo, nil
}