| 70 | }; |
| 71 | |
| 72 | void PrintUsage(const char* program) { |
| 73 | // NOTE: Please maintain flags in lexicographical order. |
| 74 | printf( |
| 75 | R"(%s - Fuzzes an equivalent SPIR-V binary based on a given binary. |
| 76 | |
| 77 | USAGE: %s [options] <input.spv> -o <output.spv> \ |
| 78 | --donors=<donors.txt> |
| 79 | USAGE: %s [options] <input.spv> -o <output.spv> \ |
| 80 | --shrink=<input.transformations> -- <interestingness_test> [args...] |
| 81 | |
| 82 | The SPIR-V binary is read from <input.spv>. If <input.facts> is also present, |
| 83 | facts about the SPIR-V binary are read from this file. |
| 84 | |
| 85 | The transformed SPIR-V binary is written to <output.spv>. Human-readable and |
| 86 | binary representations of the transformations that were applied are written to |
| 87 | <output.transformations_json> and <output.transformations>, respectively. |
| 88 | |
| 89 | When passing --shrink=<input.transformations> an <interestingness_test> |
| 90 | must also be provided; this is the path to a script that returns 0 if and only |
| 91 | if a given SPIR-V binary is interesting. The SPIR-V binary will be passed to |
| 92 | the script as an argument after any other provided arguments [args...]. The |
| 93 | "--" characters are optional but denote that all arguments that follow are |
| 94 | positional arguments and thus will be forwarded to the interestingness script, |
| 95 | and not parsed by %s. |
| 96 | |
| 97 | NOTE: The fuzzer is a work in progress. |
| 98 | |
| 99 | Options (in lexicographical order): |
| 100 | |
| 101 | -h, --help |
| 102 | Print this help. |
| 103 | --donors= |
| 104 | File specifying a series of donor files, one per line. Must be |
| 105 | provided if the tool is invoked in fuzzing mode; incompatible |
| 106 | with replay and shrink modes. The file should be empty if no |
| 107 | donors are to be used. |
| 108 | --enable-all-passes |
| 109 | By default, spirv-fuzz follows the philosophy of "swarm testing" |
| 110 | (Groce et al., 2012): only a subset of fuzzer passes are enabled |
| 111 | on any given fuzzer run, with the subset being chosen randomly. |
| 112 | This flag instead forces *all* fuzzer passes to be enabled. When |
| 113 | running spirv-fuzz many times this is likely to produce *less* |
| 114 | diverse fuzzed modules than when swarm testing is used. The |
| 115 | purpose of the flag is to allow that hypothesis to be tested. |
| 116 | --force-render-red |
| 117 | Transforms the input shader into a shader that writes red to the |
| 118 | output buffer, and then captures the original shader as the body |
| 119 | of a conditional with a dynamically false guard. Exploits input |
| 120 | facts to make the guard non-obviously false. This option is a |
| 121 | helper for massaging crash-inducing tests into a runnable |
| 122 | format; it does not perform any fuzzing. |
| 123 | --fuzzer-pass-validation |
| 124 | Run the validator after applying each fuzzer pass during |
| 125 | fuzzing. Aborts fuzzing early if an invalid binary is created. |
| 126 | Useful for debugging spirv-fuzz. |
| 127 | --repeated-pass-strategy= |
| 128 | Available strategies are: |
| 129 | - looped (the default): a sequence of fuzzer passes is chosen at |