1 //===- FuzzerFlags.def - Run-time flags -------------------------*- C++ -* ===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // Flags. FUZZER_FLAG_INT/FUZZER_FLAG_STRING macros should be defined at the 10 // point of inclusion. We are not using any flag parsing library for better 11 // portability and independence. 12 //===----------------------------------------------------------------------===// 13 FUZZER_FLAG_INT(verbosity, 1, "Verbosity level.") 14 FUZZER_FLAG_UNSIGNED(seed, 0, "Random seed. If 0, seed is generated.") 15 FUZZER_FLAG_INT(runs, -1, 16 "Number of individual test runs (-1 for infinite runs).") 17 FUZZER_FLAG_INT(max_len, 64, "Maximum length of the test input.") 18 FUZZER_FLAG_INT(cross_over, 1, "If 1, cross over inputs.") 19 FUZZER_FLAG_INT(mutate_depth, 5, 20 "Apply this number of consecutive mutations to each input.") 21 FUZZER_FLAG_INT(shuffle, 1, "Shuffle inputs at startup") 22 FUZZER_FLAG_INT( 23 prefer_small_during_initial_shuffle, -1, 24 "If 1, always prefer smaller inputs during the initial corpus shuffle." 25 " If 0, never do that. If -1, do it sometimes.") 26 FUZZER_FLAG_INT(exit_on_first, 0, 27 "If 1, exit after the first new interesting input is found.") 28 FUZZER_FLAG_INT( 29 timeout, 1200, 30 "Timeout in seconds (if positive). " 31 "If one unit runs more than this number of seconds the process will abort.") 32 FUZZER_FLAG_INT(max_total_time, 0, "If positive, indicates the maximal total " 33 "time in seconds to run the fuzzer.") 34 FUZZER_FLAG_INT(help, 0, "Print help.") 35 FUZZER_FLAG_INT(save_minimized_corpus, 0, "Deprecated. Use -merge=1") 36 FUZZER_FLAG_INT(merge, 0, "If 1, the 2-nd, 3-rd, etc corpora will be " 37 "merged into the 1-st corpus. Only interesting units will be taken.") 38 FUZZER_FLAG_INT(use_counters, 1, "Use coverage counters") 39 FUZZER_FLAG_INT(use_indir_calls, 1, "Use indirect caller-callee counters") 40 FUZZER_FLAG_INT(use_traces, 0, "Experimental: use instruction traces") 41 FUZZER_FLAG_INT(jobs, 0, "Number of jobs to run. If jobs >= 1 we spawn" 42 " this number of jobs in separate worker processes" 43 " with stdout/stderr redirected to fuzz-JOB.log.") 44 FUZZER_FLAG_INT(workers, 0, 45 "Number of simultaneous worker processes to run the jobs." 46 " If zero, \"min(jobs,NumberOfCpuCores()/2)\" is used.") 47 FUZZER_FLAG_INT(reload, 1, 48 "Reload the main corpus periodically to get new units" 49 " discovered by other processes.") 50 FUZZER_FLAG_STRING(sync_command, "Execute an external command " 51 "\"<sync_command> <test_corpus>\" " 52 "to synchronize the test corpus.") 53 FUZZER_FLAG_INT(sync_timeout, 600, "Minimum timeout between syncs.") 54 FUZZER_FLAG_INT(report_slow_units, 10, 55 "Report slowest units if they run for more than this number of seconds.") 56 FUZZER_FLAG_INT(only_ascii, 0, 57 "If 1, generate only ASCII (isprint+isspace) inputs.") 58 FUZZER_FLAG_STRING(dict, "Experimental. Use the dictionary file.") 59 FUZZER_FLAG_INT(tbm_depth, 5, "Apply at most this number of consecutive" 60 "trace-based-mutations (tbm).") 61 FUZZER_FLAG_INT(tbm_width, 5, "Apply at most this number of independent" 62 "trace-based-mutations (tbm)") 63 FUZZER_FLAG_STRING(test_single_input, "Use specified file as test input.") 64 FUZZER_FLAG_STRING(artifact_prefix, "Write fuzzing artifacts (crash, " 65 "timeout, or slow inputs) as " 66 "$(artifact_prefix)file") 67 FUZZER_FLAG_STRING(exact_artifact_path, 68 "Write the single artifact on failure (crash, timeout) " 69 "as $(exact_artifact_path). This overrides -artifact_prefix " 70 "and will not use checksum in the file name. Do not " 71 "use the same path for several parallel processes.") 72 FUZZER_FLAG_INT(drill, 0, "Experimental: fuzz using a single unit as the seed " 73 "corpus, then merge with the initial corpus") 74 FUZZER_FLAG_INT(output_csv, 0, "Enable pulse output in CSV format.") 75
