1//===- FuzzerFlags.def - Run-time flags -------------------------*- C++ -* ===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// Flags. FUZZER_FLAG_INT/FUZZER_FLAG_STRING macros should be defined at the 10// point of inclusion. We are not using any flag parsing library for better 11// portability and independence. 12//===----------------------------------------------------------------------===// 13FUZZER_FLAG_INT(verbosity, 1, "Verbosity level.") 14FUZZER_FLAG_UNSIGNED(seed, 0, "Random seed. If 0, seed is generated.") 15FUZZER_FLAG_INT(runs, -1, 16 "Number of individual test runs (-1 for infinite runs).") 17FUZZER_FLAG_INT(max_len, 64, "Maximum length of the test input.") 18FUZZER_FLAG_INT(cross_over, 1, "If 1, cross over inputs.") 19FUZZER_FLAG_INT(mutate_depth, 5, 20 "Apply this number of consecutive mutations to each input.") 21FUZZER_FLAG_INT(shuffle, 1, "Shuffle inputs at startup") 22FUZZER_FLAG_INT( 23 prefer_small_during_initial_shuffle, -1, 24 "If 1, always prefer smaller inputs during the initial corpus shuffle." 25 " If 0, never do that. If -1, do it sometimes.") 26FUZZER_FLAG_INT(exit_on_first, 0, 27 "If 1, exit after the first new interesting input is found.") 28FUZZER_FLAG_INT( 29 timeout, 1200, 30 "Timeout in seconds (if positive). " 31 "If one unit runs more than this number of seconds the process will abort.") 32FUZZER_FLAG_INT(max_total_time, 0, "If positive, indicates the maximal total " 33 "time in seconds to run the fuzzer.") 34FUZZER_FLAG_INT(help, 0, "Print help.") 35FUZZER_FLAG_INT(save_minimized_corpus, 0, "Deprecated. Use -merge=1") 36FUZZER_FLAG_INT(merge, 0, "If 1, the 2-nd, 3-rd, etc corpora will be " 37 "merged into the 1-st corpus. Only interesting units will be taken.") 38FUZZER_FLAG_INT(use_counters, 1, "Use coverage counters") 39FUZZER_FLAG_INT(use_indir_calls, 1, "Use indirect caller-callee counters") 40FUZZER_FLAG_INT(use_traces, 0, "Experimental: use instruction traces") 41FUZZER_FLAG_INT(jobs, 0, "Number of jobs to run. If jobs >= 1 we spawn" 42 " this number of jobs in separate worker processes" 43 " with stdout/stderr redirected to fuzz-JOB.log.") 44FUZZER_FLAG_INT(workers, 0, 45 "Number of simultaneous worker processes to run the jobs." 46 " If zero, \"min(jobs,NumberOfCpuCores()/2)\" is used.") 47FUZZER_FLAG_INT(reload, 1, 48 "Reload the main corpus periodically to get new units" 49 " discovered by other processes.") 50FUZZER_FLAG_STRING(sync_command, "Execute an external command " 51 "\"<sync_command> <test_corpus>\" " 52 "to synchronize the test corpus.") 53FUZZER_FLAG_INT(sync_timeout, 600, "Minimum timeout between syncs.") 54FUZZER_FLAG_INT(report_slow_units, 10, 55 "Report slowest units if they run for more than this number of seconds.") 56FUZZER_FLAG_INT(only_ascii, 0, 57 "If 1, generate only ASCII (isprint+isspace) inputs.") 58FUZZER_FLAG_STRING(dict, "Experimental. Use the dictionary file.") 59FUZZER_FLAG_INT(tbm_depth, 5, "Apply at most this number of consecutive" 60 "trace-based-mutations (tbm).") 61FUZZER_FLAG_INT(tbm_width, 5, "Apply at most this number of independent" 62 "trace-based-mutations (tbm)") 63FUZZER_FLAG_STRING(test_single_input, "Use specified file as test input.") 64FUZZER_FLAG_STRING(artifact_prefix, "Write fuzzing artifacts (crash, " 65 "timeout, or slow inputs) as " 66 "$(artifact_prefix)file") 67FUZZER_FLAG_STRING(exact_artifact_path, 68 "Write the single artifact on failure (crash, timeout) " 69 "as $(exact_artifact_path). This overrides -artifact_prefix " 70 "and will not use checksum in the file name. Do not " 71 "use the same path for several parallel processes.") 72FUZZER_FLAG_INT(drill, 0, "Experimental: fuzz using a single unit as the seed " 73 "corpus, then merge with the initial corpus") 74FUZZER_FLAG_INT(output_csv, 0, "Enable pulse output in CSV format.") 75