/build/source/bolt/runtime/instr.cpp

Bug Summary

File:	build/source/bolt/runtime/instr.cpp
Warning:	line 600, column 10 Branch condition evaluates to a garbage value

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name instr.cpp -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=cplusplus -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -ffreestanding -target-cpu x86-64 -target-feature -sse -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/build/source/build-llvm/tools/clang/stage2-bins/tools/bolt/bolt_rt-bins -resource-dir /usr/lib/llvm-17/lib/clang/17 -I . -D NDEBUG -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/x86_64-linux-gnu/c++/10 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/backward -internal-isystem /usr/lib/llvm-17/lib/clang/17/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -source-date-epoch 1680127704 -O3 -std=c++17 -fdeprecated-macro -fdebug-compilation-dir=/build/source/build-llvm/tools/clang/stage2-bins/tools/bolt/bolt_rt-bins -ferror-limit 19 -fno-rtti -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -analyzer-output=html -analyzer-config stable-report-filename=true -faddrsig -o /tmp/scan-build-2023-03-30-003104-16399-1 -x c++ /build/source/bolt/runtime/instr.cpp

/build/source/bolt/runtime/instr.cpp

→

1//===- bolt/runtime/instr.cpp ---------------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// BOLT runtime instrumentation library for x86 Linux. Currently, BOLT does
10// not support linking modules with dependencies on one another into the final
11// binary (TODO?), which means this library has to be self-contained in a single
12// module.
13//
14// All extern declarations here need to be defined by BOLT itself. Those will be
15// undefined symbols that BOLT needs to resolve by emitting these symbols with
16// MCStreamer. Currently, Passes/Instrumentation.cpp is the pass responsible
17// for defining the symbols here and these two files have a tight coupling: one
18// working statically when you run BOLT and another during program runtime when
19// you run an instrumented binary. The main goal here is to output an fdata file
20// (BOLT profile) with the instrumentation counters inserted by the static pass.
21// Counters for indirect calls are an exception, as we can't know them
22// statically. These counters are created and managed here. To allow this, we
23// need a minimal framework for allocating memory dynamically. We provide this
24// with the BumpPtrAllocator class (not LLVM's, but our own version of it).
25//
26// Since this code is intended to be inserted into any executable, we decided to
27// make it standalone and do not depend on any external libraries (i.e. language
28// support libraries, such as glibc or stdc++). To allow this, we provide a few
29// light implementations of common OS interacting functionalities using direct
30// syscall wrappers. Our simple allocator doesn't manage deallocations that
31// fragment the memory space, so it's stack based. This is the minimal framework
32// provided here to allow processing instrumented counters and writing fdata.
33//
34// In the C++ idiom used here, we never use or rely on constructors or
35// destructors for global objects. That's because those need support from the
36// linker in initialization/finalization code, and we want to keep our linker
37// very simple. Similarly, we don't create any global objects that are zero
38// initialized, since those would need to go .bss, which our simple linker also
39// don't support (TODO?).
40//
41//===----------------------------------------------------------------------===//

43#if defined (__x86_64__1)
44#include "common.h"

46// Enables a very verbose logging to stderr useful when debugging
47//#define ENABLE_DEBUG

49#ifdef ENABLE_DEBUG
50#define DEBUG(X){}                                                               \
{ X; }
52#else
53#define DEBUG(X){}                                                               \
{}
55#endif

57#pragma GCC visibility push(hidden)

59extern "C" {

61#if defined(__APPLE__)
62extern uint64_t* _bolt_instr_locations_getter();
63extern uint32_t _bolt_num_counters_getter();

65extern uint8_t* _bolt_instr_tables_getter();
66extern uint32_t _bolt_instr_num_funcs_getter();

68#else

70// Main counters inserted by instrumentation, incremented during runtime when
71// points of interest (locations) in the program are reached. Those are direct
72// calls and direct and indirect branches (local ones). There are also counters
73// for basic block execution if they are a spanning tree leaf and need to be
74// counted in order to infer the execution count of other edges of the CFG.
75extern uint64_t __bolt_instr_locations[];
76extern uint32_t __bolt_num_counters;
77// Descriptions are serialized metadata about binary functions written by BOLT,
78// so we have a minimal understanding about the program structure. For a
79// reference on the exact format of this metadata, see *Description structs,
80// Location, IntrumentedNode and EntryNode.
81// Number of indirect call site descriptions
82extern uint32_t __bolt_instr_num_ind_calls;
83// Number of indirect call target descriptions
84extern uint32_t __bolt_instr_num_ind_targets;
85// Number of function descriptions
86extern uint32_t __bolt_instr_num_funcs;
87// Time to sleep across dumps (when we write the fdata profile to disk)
88extern uint32_t __bolt_instr_sleep_time;
89// Do not clear counters across dumps, rewrite file with the updated values
90extern bool __bolt_instr_no_counters_clear;
91// Wait until all forks of instrumented process will finish
92extern bool __bolt_instr_wait_forks;
93// Filename to dump data to
94extern char __bolt_instr_filename[];
95// Instumented binary file path
96extern char __bolt_instr_binpath[];
97// If true, append current PID to the fdata filename when creating it so
98// different invocations of the same program can be differentiated.
99extern bool __bolt_instr_use_pid;
100// Functions that will be used to instrument indirect calls. BOLT static pass
101// will identify indirect calls and modify them to load the address in these
102// trampolines and call this address instead. BOLT can't use direct calls to
103// our handlers because our addresses here are not known at analysis time. We
104// only support resolving dependencies from this file to the output of BOLT,
105// *not* the other way around.
106// TODO: We need better linking support to make that happen.
107extern void (*__bolt_ind_call_counter_func_pointer)();
108extern void (*__bolt_ind_tailcall_counter_func_pointer)();
109// Function pointers to init/fini trampoline routines in the binary, so we can
110// resume regular execution of these functions that we hooked
111extern void __bolt_start_trampoline();
112extern void __bolt_fini_trampoline();

114#endif
115}

117namespace {

119/// A simple allocator that mmaps a fixed size region and manages this space
120/// in a stack fashion, meaning you always deallocate the last element that
121/// was allocated. In practice, we don't need to deallocate individual elements.
122/// We monotonically increase our usage and then deallocate everything once we
123/// are done processing something.
124class BumpPtrAllocator {
/// This is written before each allocation and act as a canary to detect when
/// a bug caused our program to cross allocation boundaries.
struct EntryMetadata {
  uint64_t Magic;
  uint64_t AllocSize;
};

132public:
void *allocate(size_t Size) {
  Lock L(M);

  if (StackBase == nullptr) {
137#if defined(__APPLE__)
  int MAP_PRIVATE_MAP_ANONYMOUS = 0x1002;
139#else
  int MAP_PRIVATE_MAP_ANONYMOUS = 0x22;
141#endif
    StackBase = reinterpret_cast<uint8_t *>(
        __mmap(0, MaxSize, 0x3 /* PROT_READ | PROT_WRITE*/,
               Shared ? 0x21 /*MAP_SHARED | MAP_ANONYMOUS*/
                      : MAP_PRIVATE_MAP_ANONYMOUS /* MAP_PRIVATE | MAP_ANONYMOUS*/,
               -1, 0));
    StackSize = 0;
  }

  Size = alignTo(Size + sizeof(EntryMetadata), 16);
  uint8_t *AllocAddress = StackBase + StackSize + sizeof(EntryMetadata);
  auto *M = reinterpret_cast<EntryMetadata *>(StackBase + StackSize);
  M->Magic = Magic;
  M->AllocSize = Size;
  StackSize += Size;
  assert(StackSize < MaxSize, "allocator ran out of memory");
  return AllocAddress;
}

160#ifdef DEBUG
/// Element-wise deallocation is only used for debugging to catch memory
/// bugs by checking magic bytes. Ordinarily, we reset the allocator once
/// we are done with it. Reset is done with clear(). There's no need
/// to deallocate each element individually.
void deallocate(void *Ptr) {
  Lock L(M);
  uint8_t MetadataOffset = sizeof(EntryMetadata);
  auto *M = reinterpret_cast<EntryMetadata *>(
      reinterpret_cast<uint8_t *>(Ptr) - MetadataOffset);
  const uint8_t *StackTop = StackBase + StackSize + MetadataOffset;
  // Validate size
  if (Ptr != StackTop - M->AllocSize) {
    // Failed validation, check if it is a pointer returned by operator new []
    MetadataOffset +=
        sizeof(uint64_t); // Space for number of elements alloc'ed
    M = reinterpret_cast<EntryMetadata *>(reinterpret_cast<uint8_t *>(Ptr) -
                                          MetadataOffset);
    // Ok, it failed both checks if this assertion fails. Stop the program, we
    // have a memory bug.
    assert(Ptr == StackTop - M->AllocSize,
           "must deallocate the last element alloc'ed");
  }
  assert(M->Magic == Magic, "allocator magic is corrupt");
  StackSize -= M->AllocSize;
}
186#else
void deallocate(void *) {}
188#endif

void clear() {
  Lock L(M);
  StackSize = 0;
}

/// Set mmap reservation size (only relevant before first allocation)
void setMaxSize(uint64_t Size) { MaxSize = Size; }

/// Set mmap reservation privacy (only relevant before first allocation)
void setShared(bool S) { Shared = S; }

void destroy() {
  if (StackBase == nullptr)
    return;
  __munmap(StackBase, MaxSize);
}

207private:
static constexpr uint64_t Magic = 0x1122334455667788ull;
uint64_t MaxSize = 0xa00000;
uint8_t *StackBase{nullptr};
uint64_t StackSize{0};
bool Shared{false};
Mutex M;
214};

216/// Used for allocating indirect call instrumentation counters. Initialized by
217/// __bolt_instr_setup, our initialization routine.
218BumpPtrAllocator GlobalAlloc;
219} // anonymous namespace

221// User-defined placement new operators. We only use those (as opposed to
222// overriding the regular operator new) so we can keep our allocator in the
223// stack instead of in a data section (global).
224void *operator new(size_t Sz, BumpPtrAllocator &A) { return A.allocate(Sz); }
225void *operator new(size_t Sz, BumpPtrAllocator &A, char C) {
auto *Ptr = reinterpret_cast<char *>(A.allocate(Sz));
memset(Ptr, C, Sz);
return Ptr;
229}
230void *operator new[](size_t Sz, BumpPtrAllocator &A) {
return A.allocate(Sz);
232}
233void *operator new[](size_t Sz, BumpPtrAllocator &A, char C) {
auto *Ptr = reinterpret_cast<char *>(A.allocate(Sz));
memset(Ptr, C, Sz);
return Ptr;
237}
238// Only called during exception unwinding (useless). We must manually dealloc.
239// C++ language weirdness
240void operator delete(void *Ptr, BumpPtrAllocator &A) { A.deallocate(Ptr); }

242namespace {

244// Disable instrumentation optimizations that sacrifice profile accuracy
245extern "C" bool __bolt_instr_conservative;

247/// Basic key-val atom stored in our hash
248struct SimpleHashTableEntryBase {
uint64_t Key;
uint64_t Val;
251};

253/// This hash table implementation starts by allocating a table of size
254/// InitialSize. When conflicts happen in this main table, it resolves
255/// them by chaining a new table of size IncSize. It never reallocs as our
256/// allocator doesn't support it. The key is intended to be function pointers.
257/// There's no clever hash function (it's just x mod size, size being prime).
258/// I never tuned the coefficientes in the modular equation (TODO)
259/// This is used for indirect calls (each call site has one of this, so it
260/// should have a small footprint) and for tallying call counts globally for
261/// each target to check if we missed the origin of some calls (this one is a
262/// large instantiation of this template, since it is global for all call sites)
263template <typename T = SimpleHashTableEntryBase, uint32_t InitialSize = 7,
        uint32_t IncSize = 7>
265class SimpleHashTable {
266public:
using MapEntry = T;

/// Increment by 1 the value of \p Key. If it is not in this table, it will be
/// added to the table and its value set to 1.
void incrementVal(uint64_t Key, BumpPtrAllocator &Alloc) {
  ++get(Key, Alloc).Val;
}

/// Basic member accessing interface. Here we pass the allocator explicitly to
/// avoid storing a pointer to it as part of this table (remember there is one
/// hash for each indirect call site, so we wan't to minimize our footprint).
MapEntry &get(uint64_t Key, BumpPtrAllocator &Alloc) {
  if (!__bolt_instr_conservative) {
    TryLock L(M);
    if (!L.isLocked())
      return NoEntry;
    return getOrAllocEntry(Key, Alloc);
  }
  Lock L(M);
  return getOrAllocEntry(Key, Alloc);
}

/// Traverses all elements in the table
template <typename... Args>
void forEachElement(void (*Callback)(MapEntry &, Args...), Args... args) {
  Lock L(M);
  if (!TableRoot)
    return;
  return forEachElement(Callback, InitialSize, TableRoot, args...);
}

void resetCounters();

300private:
constexpr static uint64_t VacantMarker = 0;
constexpr static uint64_t FollowUpTableMarker = 0x8000000000000000ull;

MapEntry *TableRoot{nullptr};
MapEntry NoEntry;
Mutex M;

template <typename... Args>
void forEachElement(void (*Callback)(MapEntry &, Args...),
                    uint32_t NumEntries, MapEntry *Entries, Args... args) {
  for (uint32_t I = 0; I < NumEntries; ++I) {
    MapEntry &Entry = Entries[I];
    if (Entry.Key == VacantMarker)
      continue;
    if (Entry.Key & FollowUpTableMarker) {
      forEachElement(Callback, IncSize,
                     reinterpret_cast<MapEntry *>(Entry.Key &
                                                  ~FollowUpTableMarker),
                     args...);
      continue;
    }
    Callback(Entry, args...);
  }
}

MapEntry &firstAllocation(uint64_t Key, BumpPtrAllocator &Alloc) {
  TableRoot = new (Alloc, 0) MapEntry[InitialSize];
  MapEntry &Entry = TableRoot[Key % InitialSize];
  Entry.Key = Key;
  return Entry;
}

MapEntry &getEntry(MapEntry *Entries, uint64_t Key, uint64_t Selector,
                   BumpPtrAllocator &Alloc, int CurLevel) {
  const uint32_t NumEntries = CurLevel == 0 ? InitialSize : IncSize;
  uint64_t Remainder = Selector / NumEntries;
  Selector = Selector % NumEntries;
  MapEntry &Entry = Entries[Selector];

  // A hit
  if (Entry.Key == Key) {
    return Entry;
  }

  // Vacant - add new entry
  if (Entry.Key == VacantMarker) {
    Entry.Key = Key;
    return Entry;
  }

  // Defer to the next level
  if (Entry.Key & FollowUpTableMarker) {
    return getEntry(
        reinterpret_cast<MapEntry *>(Entry.Key & ~FollowUpTableMarker),
        Key, Remainder, Alloc, CurLevel + 1);
  }

  // Conflict - create the next level
  MapEntry *NextLevelTbl = new (Alloc, 0) MapEntry[IncSize];
  uint64_t CurEntrySelector = Entry.Key / InitialSize;
  for (int I = 0; I < CurLevel; ++I)
    CurEntrySelector /= IncSize;
  CurEntrySelector = CurEntrySelector % IncSize;
  NextLevelTbl[CurEntrySelector] = Entry;
  Entry.Key = reinterpret_cast<uint64_t>(NextLevelTbl) | FollowUpTableMarker;
  return getEntry(NextLevelTbl, Key, Remainder, Alloc, CurLevel + 1);
}

MapEntry &getOrAllocEntry(uint64_t Key, BumpPtrAllocator &Alloc) {
  if (TableRoot)
    return getEntry(TableRoot, Key, Key, Alloc, 0);
  return firstAllocation(Key, Alloc);
}
374};

376template <typename T> void resetIndCallCounter(T &Entry) {
Entry.Val = 0;
378}

380template <typename T, uint32_t X, uint32_t Y>
381void SimpleHashTable<T, X, Y>::resetCounters() {
forEachElement(resetIndCallCounter);
383}

385/// Represents a hash table mapping a function target address to its counter.
386using IndirectCallHashTable = SimpleHashTable<>;

388/// Initialize with number 1 instead of 0 so we don't go into .bss. This is the
389/// global array of all hash tables storing indirect call destinations happening
390/// during runtime, one table per call site.
391IndirectCallHashTable *GlobalIndCallCounters{
  reinterpret_cast<IndirectCallHashTable *>(1)};

394/// Don't allow reentrancy in the fdata writing phase - only one thread writes
395/// it
396Mutex *GlobalWriteProfileMutex{reinterpret_cast<Mutex *>(1)};

398/// Store number of calls in additional to target address (Key) and frequency
399/// as perceived by the basic block counter (Val).
400struct CallFlowEntryBase : public SimpleHashTableEntryBase {
uint64_t Calls;
402};

404using CallFlowHashTableBase = SimpleHashTable<CallFlowEntryBase, 11939, 233>;

406/// This is a large table indexing all possible call targets (indirect and
407/// direct ones). The goal is to find mismatches between number of calls (for
408/// those calls we were able to track) and the entry basic block counter of the
409/// callee. In most cases, these two should be equal. If not, there are two
410/// possible scenarios here:
411///
412///  * Entry BB has higher frequency than all known calls to this function.
413///    In this case, we have dynamic library code or any uninstrumented code
414///    calling this function. We will write the profile for these untracked
415///    calls as having source "0 [unknown] 0" in the fdata file.
416///
417///  * Number of known calls is higher than the frequency of entry BB
418///    This only happens when there is no counter for the entry BB / callee
419///    function is not simple (in BOLT terms). We don't do anything special
420///    here and just ignore those (we still report all calls to the non-simple
421///    function, though).
422///
423class CallFlowHashTable : public CallFlowHashTableBase {
424public:
CallFlowHashTable(BumpPtrAllocator &Alloc) : Alloc(Alloc) {}

MapEntry &get(uint64_t Key) { return CallFlowHashTableBase::get(Key, Alloc); }

429private:
// Different than the hash table for indirect call targets, we do store the
// allocator here since there is only one call flow hash and space overhead
// is negligible.
BumpPtrAllocator &Alloc;
434};

436///
437/// Description metadata emitted by BOLT to describe the program - refer to
438/// Passes/Instrumentation.cpp - Instrumentation::emitTablesAsELFNote()
439///
440struct Location {
uint32_t FunctionName;
uint32_t Offset;
443};

445struct CallDescription {
Location From;
uint32_t FromNode;
Location To;
uint32_t Counter;
uint64_t TargetAddress;
451};

453using IndCallDescription = Location;

455struct IndCallTargetDescription {
Location Loc;
uint64_t Address;
458};

460struct EdgeDescription {
Location From;
uint32_t FromNode;
Location To;
uint32_t ToNode;
uint32_t Counter;
466};

468struct InstrumentedNode {
uint32_t Node;
uint32_t Counter;
471};

473struct EntryNode {
uint64_t Node;
uint64_t Address;
476};

478struct FunctionDescription {
uint32_t NumLeafNodes;
const InstrumentedNode *LeafNodes;
uint32_t NumEdges;
const EdgeDescription *Edges;
uint32_t NumCalls;
const CallDescription *Calls;
uint32_t NumEntryNodes;
const EntryNode *EntryNodes;

/// Constructor will parse the serialized function metadata written by BOLT
FunctionDescription(const uint8_t *FuncDesc);

uint64_t getSize() const {
  return 16 + NumLeafNodes * sizeof(InstrumentedNode) +
         NumEdges * sizeof(EdgeDescription) +
         NumCalls * sizeof(CallDescription) +
         NumEntryNodes * sizeof(EntryNode);
}
497};

499/// The context is created when the fdata profile needs to be written to disk
500/// and we need to interpret our runtime counters. It contains pointers to the
501/// mmaped binary (only the BOLT written metadata section). Deserialization
502/// should be straightforward as most data is POD or an array of POD elements.
503/// This metadata is used to reconstruct function CFGs.
504struct ProfileWriterContext {
IndCallDescription *IndCallDescriptions;
IndCallTargetDescription *IndCallTargets;
uint8_t *FuncDescriptions;
char *Strings;  // String table with function names used in this binary
int FileDesc;   // File descriptor for the file on disk backing this
                // information in memory via mmap
void *MMapPtr;  // The mmap ptr
int MMapSize;   // The mmap size

/// Hash table storing all possible call destinations to detect untracked
/// calls and correctly report them as [unknown] in output fdata.
CallFlowHashTable *CallFlowTable;

/// Lookup the sorted indirect call target vector to fetch function name and
/// offset for an arbitrary function pointer.
const IndCallTargetDescription *lookupIndCallTarget(uint64_t Target) const;
521};

523/// Perform a string comparison and returns zero if Str1 matches Str2. Compares
524/// at most Size characters.
525int compareStr(const char *Str1, const char *Str2, int Size) {
while (*Str1 == *Str2) {
  if (*Str1 == '\0' || --Size == 0)
    return 0;
  ++Str1;
  ++Str2;
}
return 1;
533}

535/// Output Location to the fdata file
536char *serializeLoc(const ProfileWriterContext &Ctx, char *OutBuf,
                 const Location Loc, uint32_t BufSize) {
// fdata location format: Type Name Offset
// Type 1 - regular symbol
OutBuf = strCopy(OutBuf, "1 ");
const char *Str = Ctx.Strings + Loc.FunctionName;
uint32_t Size = 25;
while (*Str) {
  *OutBuf++ = *Str++;
  if (++Size >= BufSize)
    break;
}
assert(!*Str, "buffer overflow, function name too large");
*OutBuf++ = ' ';
OutBuf = intToStr(OutBuf, Loc.Offset, 16);
*OutBuf++ = ' ';
return OutBuf;
553}

555/// Read and deserialize a function description written by BOLT. \p FuncDesc
556/// points at the beginning of the function metadata structure in the file.
557/// See Instrumentation::emitTablesAsELFNote()
558FunctionDescription::FunctionDescription(const uint8_t *FuncDesc) {
NumLeafNodes = *reinterpret_cast<const uint32_t *>(FuncDesc);
DEBUG(reportNumber("NumLeafNodes = ", NumLeafNodes, 10)){};
LeafNodes = reinterpret_cast<const InstrumentedNode *>(FuncDesc + 4);

NumEdges = *reinterpret_cast<const uint32_t *>(
    FuncDesc + 4 + NumLeafNodes * sizeof(InstrumentedNode));
DEBUG(reportNumber("NumEdges = ", NumEdges, 10)){};
Edges = reinterpret_cast<const EdgeDescription *>(
    FuncDesc + 8 + NumLeafNodes * sizeof(InstrumentedNode));

NumCalls = *reinterpret_cast<const uint32_t *>(
    FuncDesc + 8 + NumLeafNodes * sizeof(InstrumentedNode) +
    NumEdges * sizeof(EdgeDescription));
DEBUG(reportNumber("NumCalls = ", NumCalls, 10)){};
Calls = reinterpret_cast<const CallDescription *>(
    FuncDesc + 12 + NumLeafNodes * sizeof(InstrumentedNode) +
    NumEdges * sizeof(EdgeDescription));
NumEntryNodes = *reinterpret_cast<const uint32_t *>(
    FuncDesc + 12 + NumLeafNodes * sizeof(InstrumentedNode) +
    NumEdges * sizeof(EdgeDescription) + NumCalls * sizeof(CallDescription));
DEBUG(reportNumber("NumEntryNodes = ", NumEntryNodes, 10)){};
EntryNodes = reinterpret_cast<const EntryNode *>(
    FuncDesc + 16 + NumLeafNodes * sizeof(InstrumentedNode) +
    NumEdges * sizeof(EdgeDescription) + NumCalls * sizeof(CallDescription));
583}

585/// Read and mmap descriptions written by BOLT from the executable's notes
586/// section
587#if defined(HAVE_ELF_H) and !defined(__APPLE__)

589void *__attribute__((noinline)) __get_pc() {
return __builtin_extract_return_addr(__builtin_return_address(0));
591}

593/// Get string with address and parse it to hex pair <StartAddress, EndAddress>
594bool parseAddressRange(const char *Str, uint64_t &StartAddress,
                     uint64_t &EndAddress) {
if (!Str17.1
'Str' is non-null
1
'Str' is non-null
)
18
←
Taking false branch→
  return false;
// Parsed string format: <hex1>-<hex2>
StartAddress = hexToLong(Str, '-');
while (*Str && *Str != '-')
19
←
Branch condition evaluates to a garbage value
  ++Str;
if (!*Str)
  return false;
++Str; // swallow '-'
EndAddress = hexToLong(Str);
return true;
607}

609/// Get full path to the real binary by getting current virtual address
610/// and searching for the appropriate link in address range in
611/// /proc/self/map_files
612static char *getBinaryPath() {
const uint32_t BufSize = 1024;
const uint32_t NameMax = 4096;
const char DirPath[] = "/proc/self/map_files/";
static char TargetPath[NameMax] = {};
char Buf[BufSize];

if (__bolt_instr_binpath[0] != '\0')
7
←
Assuming the condition is false→
8
←
Taking false branch→
  return __bolt_instr_binpath;

if (TargetPath[0] != '\0')
9
←
Taking false branch→
  return TargetPath;

unsigned long CurAddr = (unsigned long)__get_pc();
uint64_t FDdir = __open(DirPath,
                        /*flags=*/0 /*O_RDONLY*/,
                        /*mode=*/0666);
assert(static_cast<int64_t>(FDdir) >= 0,
10
←
Assuming 'FDdir' is >= 0→
       "failed to open /proc/self/map_files");

while (long Nread = __getdents(FDdir, (struct dirent *)Buf, BufSize)) {
11
←
Calling '__getdents'→
12
←
Returning from '__getdents'→
13
←
Loop condition is true.  Entering loop body→
  assert(static_cast<int64_t>(Nread) != -1, "failed to get folder entries");
14
←
Assuming the condition is true→

  struct dirent *d;
  for (long Bpos = 0; Bpos < Nread; Bpos += d->d_reclen) {
15
←
Assuming 'Bpos' is < 'Nread'→
16
←
Loop condition is true.  Entering loop body→
    d = (struct dirent *)(Buf + Bpos);

    uint64_t StartAddress, EndAddress;
    if (!parseAddressRange(d->d_name, StartAddress, EndAddress))
17
←
Calling 'parseAddressRange'→
      continue;
    if (CurAddr < StartAddress || CurAddr > EndAddress)
      continue;
    char FindBuf[NameMax];
    char *C = strCopy(FindBuf, DirPath, NameMax);
    C = strCopy(C, d->d_name, NameMax - (C - FindBuf));
    *C = '\0';
    uint32_t Ret = __readlink(FindBuf, TargetPath, sizeof(TargetPath));
    assert(Ret != -1 && Ret != BufSize, "readlink error");
    TargetPath[Ret] = '\0';
    return TargetPath;
  }
}
return nullptr;
655}

657ProfileWriterContext readDescriptions() {
ProfileWriterContext Result;
char *BinPath = getBinaryPath();
6
←
Calling 'getBinaryPath'→
assert(BinPath && BinPath[0] != '\0', "failed to find binary path");

uint64_t FD = __open(BinPath,
                     /*flags=*/0 /*O_RDONLY*/,
                     /*mode=*/0666);
assert(static_cast<int64_t>(FD) >= 0, "failed to open binary path");

Result.FileDesc = FD;

// mmap our binary to memory
uint64_t Size = __lseek(FD, 0, 2 /*SEEK_END*/);
uint8_t *BinContents = reinterpret_cast<uint8_t *>(
    __mmap(0, Size, 0x1 /* PROT_READ*/, 0x2 /* MAP_PRIVATE*/, FD, 0));
Result.MMapPtr = BinContents;
Result.MMapSize = Size;
Elf64_Ehdr *Hdr = reinterpret_cast<Elf64_Ehdr *>(BinContents);
Elf64_Shdr *Shdr = reinterpret_cast<Elf64_Shdr *>(BinContents + Hdr->e_shoff);
Elf64_Shdr *StringTblHeader = reinterpret_cast<Elf64_Shdr *>(
    BinContents + Hdr->e_shoff + Hdr->e_shstrndx * Hdr->e_shentsize);

// Find .bolt.instr.tables with the data we need and set pointers to it
for (int I = 0; I < Hdr->e_shnum; ++I) {
  char *SecName = reinterpret_cast<char *>(
      BinContents + StringTblHeader->sh_offset + Shdr->sh_name);
  if (compareStr(SecName, ".bolt.instr.tables", 64) != 0) {
    Shdr = reinterpret_cast<Elf64_Shdr *>(BinContents + Hdr->e_shoff +
                                          (I + 1) * Hdr->e_shentsize);
    continue;
  }
  // Actual contents of the ELF note start after offset 20 decimal:
  // Offset 0: Producer name size (4 bytes)
  // Offset 4: Contents size (4 bytes)
  // Offset 8: Note type (4 bytes)
  // Offset 12: Producer name (BOLT\0) (5 bytes + align to 4-byte boundary)
  // Offset 20: Contents
  uint32_t IndCallDescSize =
      *reinterpret_cast<uint32_t *>(BinContents + Shdr->sh_offset + 20);
  uint32_t IndCallTargetDescSize = *reinterpret_cast<uint32_t *>(
      BinContents + Shdr->sh_offset + 24 + IndCallDescSize);
  uint32_t FuncDescSize =
      *reinterpret_cast<uint32_t *>(BinContents + Shdr->sh_offset + 28 +
                                    IndCallDescSize + IndCallTargetDescSize);
  Result.IndCallDescriptions = reinterpret_cast<IndCallDescription *>(
      BinContents + Shdr->sh_offset + 24);
  Result.IndCallTargets = reinterpret_cast<IndCallTargetDescription *>(
      BinContents + Shdr->sh_offset + 28 + IndCallDescSize);
  Result.FuncDescriptions = BinContents + Shdr->sh_offset + 32 +
                            IndCallDescSize + IndCallTargetDescSize;
  Result.Strings = reinterpret_cast<char *>(
      BinContents + Shdr->sh_offset + 32 + IndCallDescSize +
      IndCallTargetDescSize + FuncDescSize);
  return Result;
}
const char ErrMsg[] =
    "BOLT instrumentation runtime error: could not find section "
    ".bolt.instr.tables\n";
reportError(ErrMsg, sizeof(ErrMsg));
return Result;
718}

720#else

722ProfileWriterContext readDescriptions() {
ProfileWriterContext Result;
uint8_t *Tables = _bolt_instr_tables_getter();
uint32_t IndCallDescSize = *reinterpret_cast<uint32_t *>(Tables);
uint32_t IndCallTargetDescSize =
    *reinterpret_cast<uint32_t *>(Tables + 4 + IndCallDescSize);
uint32_t FuncDescSize = *reinterpret_cast<uint32_t *>(
    Tables + 8 + IndCallDescSize + IndCallTargetDescSize);
Result.IndCallDescriptions =
    reinterpret_cast<IndCallDescription *>(Tables + 4);
Result.IndCallTargets = reinterpret_cast<IndCallTargetDescription *>(
    Tables + 8 + IndCallDescSize);
Result.FuncDescriptions =
    Tables + 12 + IndCallDescSize + IndCallTargetDescSize;
Result.Strings = reinterpret_cast<char *>(
    Tables + 12 + IndCallDescSize + IndCallTargetDescSize + FuncDescSize);
return Result;
739}

741#endif

743#if !defined(__APPLE__)
744/// Debug by printing overall metadata global numbers to check it is sane
745void printStats(const ProfileWriterContext &Ctx) {
char StatMsg[BufSize];
char *StatPtr = StatMsg;
StatPtr =
    strCopy(StatPtr,
            "\nBOLT INSTRUMENTATION RUNTIME STATISTICS\n\nIndCallDescSize: ");
StatPtr = intToStr(StatPtr,
                   Ctx.FuncDescriptions -
                       reinterpret_cast<uint8_t *>(Ctx.IndCallDescriptions),
                   10);
StatPtr = strCopy(StatPtr, "\nFuncDescSize: ");
StatPtr = intToStr(
    StatPtr,
    reinterpret_cast<uint8_t *>(Ctx.Strings) - Ctx.FuncDescriptions, 10);
StatPtr = strCopy(StatPtr, "\n__bolt_instr_num_ind_calls: ");
StatPtr = intToStr(StatPtr, __bolt_instr_num_ind_calls, 10);
StatPtr = strCopy(StatPtr, "\n__bolt_instr_num_funcs: ");
StatPtr = intToStr(StatPtr, __bolt_instr_num_funcs, 10);
StatPtr = strCopy(StatPtr, "\n");
__write(2, StatMsg, StatPtr - StatMsg);
765}
766#endif


769/// This is part of a simple CFG representation in memory, where we store
770/// a dynamically sized array of input and output edges per node, and store
771/// a dynamically sized array of nodes per graph. We also store the spanning
772/// tree edges for that CFG in a separate array of nodes in
773/// \p SpanningTreeNodes, while the regular nodes live in \p CFGNodes.
774struct Edge {
uint32_t Node; // Index in nodes array regarding the destination of this edge
uint32_t ID;   // Edge index in an array comprising all edges of the graph
777};

779/// A regular graph node or a spanning tree node
780struct Node {
uint32_t NumInEdges{0};  // Input edge count used to size InEdge
uint32_t NumOutEdges{0}; // Output edge count used to size OutEdges
Edge *InEdges{nullptr};  // Created and managed by \p Graph
Edge *OutEdges{nullptr}; // ditto
785};

787/// Main class for CFG representation in memory. Manages object creation and
788/// destruction, populates an array of CFG nodes as well as corresponding
789/// spanning tree nodes.
790struct Graph {
uint32_t NumNodes;
Node *CFGNodes;
Node *SpanningTreeNodes;
uint64_t *EdgeFreqs;
uint64_t *CallFreqs;
BumpPtrAllocator &Alloc;
const FunctionDescription &D;

/// Reads a list of edges from function description \p D and builds
/// the graph from it. Allocates several internal dynamic structures that are
/// later destroyed by ~Graph() and uses \p Alloc. D.LeafNodes contain all
/// spanning tree leaf nodes descriptions (their counters). They are the seed
/// used to compute the rest of the missing edge counts in a bottom-up
/// traversal of the spanning tree.
Graph(BumpPtrAllocator &Alloc, const FunctionDescription &D,
      const uint64_t *Counters, ProfileWriterContext &Ctx);
~Graph();
void dump() const;

810private:
void computeEdgeFrequencies(const uint64_t *Counters,
                            ProfileWriterContext &Ctx);
void dumpEdgeFreqs() const;
814};

816Graph::Graph(BumpPtrAllocator &Alloc, const FunctionDescription &D,
           const uint64_t *Counters, ProfileWriterContext &Ctx)
  : Alloc(Alloc), D(D) {
DEBUG(reportNumber("G = 0x", (uint64_t)this, 16)){};
// First pass to determine number of nodes
int32_t MaxNodes = -1;
CallFreqs = nullptr;
EdgeFreqs = nullptr;
for (int I = 0; I < D.NumEdges; ++I) {
  if (static_cast<int32_t>(D.Edges[I].FromNode) > MaxNodes)
    MaxNodes = D.Edges[I].FromNode;
  if (static_cast<int32_t>(D.Edges[I].ToNode) > MaxNodes)
    MaxNodes = D.Edges[I].ToNode;
}

for (int I = 0; I < D.NumLeafNodes; ++I)
  if (static_cast<int32_t>(D.LeafNodes[I].Node) > MaxNodes)
    MaxNodes = D.LeafNodes[I].Node;

for (int I = 0; I < D.NumCalls; ++I)
  if (static_cast<int32_t>(D.Calls[I].FromNode) > MaxNodes)
    MaxNodes = D.Calls[I].FromNode;

// No nodes? Nothing to do
if (MaxNodes < 0) {
  DEBUG(report("No nodes!\n")){};
  CFGNodes = nullptr;
  SpanningTreeNodes = nullptr;
  NumNodes = 0;
  return;
}
++MaxNodes;
DEBUG(reportNumber("NumNodes = ", MaxNodes, 10)){};
NumNodes = static_cast<uint32_t>(MaxNodes);

// Initial allocations
CFGNodes = new (Alloc) Node[MaxNodes];

DEBUG(reportNumber("G->CFGNodes = 0x", (uint64_t)CFGNodes, 16)){};
SpanningTreeNodes = new (Alloc) Node[MaxNodes];
DEBUG(reportNumber("G->SpanningTreeNodes = 0x",{}
                   (uint64_t)SpanningTreeNodes, 16)){};

// Figure out how much to allocate to each vector (in/out edge sets)
for (int I = 0; I < D.NumEdges; ++I) {
  CFGNodes[D.Edges[I].FromNode].NumOutEdges++;
  CFGNodes[D.Edges[I].ToNode].NumInEdges++;
  if (D.Edges[I].Counter != 0xffffffff)
    continue;

  SpanningTreeNodes[D.Edges[I].FromNode].NumOutEdges++;
  SpanningTreeNodes[D.Edges[I].ToNode].NumInEdges++;
}

// Allocate in/out edge sets
for (int I = 0; I < MaxNodes; ++I) {
  if (CFGNodes[I].NumInEdges > 0)
    CFGNodes[I].InEdges = new (Alloc) Edge[CFGNodes[I].NumInEdges];
  if (CFGNodes[I].NumOutEdges > 0)
    CFGNodes[I].OutEdges = new (Alloc) Edge[CFGNodes[I].NumOutEdges];
  if (SpanningTreeNodes[I].NumInEdges > 0)
    SpanningTreeNodes[I].InEdges =
        new (Alloc) Edge[SpanningTreeNodes[I].NumInEdges];
  if (SpanningTreeNodes[I].NumOutEdges > 0)
    SpanningTreeNodes[I].OutEdges =
        new (Alloc) Edge[SpanningTreeNodes[I].NumOutEdges];
  CFGNodes[I].NumInEdges = 0;
  CFGNodes[I].NumOutEdges = 0;
  SpanningTreeNodes[I].NumInEdges = 0;
  SpanningTreeNodes[I].NumOutEdges = 0;
}

// Fill in/out edge sets
for (int I = 0; I < D.NumEdges; ++I) {
  const uint32_t Src = D.Edges[I].FromNode;
  const uint32_t Dst = D.Edges[I].ToNode;
  Edge *E = &CFGNodes[Src].OutEdges[CFGNodes[Src].NumOutEdges++];
  E->Node = Dst;
  E->ID = I;

  E = &CFGNodes[Dst].InEdges[CFGNodes[Dst].NumInEdges++];
  E->Node = Src;
  E->ID = I;

  if (D.Edges[I].Counter != 0xffffffff)
    continue;

  E = &SpanningTreeNodes[Src]
           .OutEdges[SpanningTreeNodes[Src].NumOutEdges++];
  E->Node = Dst;
  E->ID = I;

  E = &SpanningTreeNodes[Dst]
           .InEdges[SpanningTreeNodes[Dst].NumInEdges++];
  E->Node = Src;
  E->ID = I;
}

computeEdgeFrequencies(Counters, Ctx);
915}

917Graph::~Graph() {
if (CallFreqs)
  Alloc.deallocate(CallFreqs);
if (EdgeFreqs)
  Alloc.deallocate(EdgeFreqs);
for (int I = NumNodes - 1; I >= 0; --I) {
  if (SpanningTreeNodes[I].OutEdges)
    Alloc.deallocate(SpanningTreeNodes[I].OutEdges);
  if (SpanningTreeNodes[I].InEdges)
    Alloc.deallocate(SpanningTreeNodes[I].InEdges);
  if (CFGNodes[I].OutEdges)
    Alloc.deallocate(CFGNodes[I].OutEdges);
  if (CFGNodes[I].InEdges)
    Alloc.deallocate(CFGNodes[I].InEdges);
}
if (SpanningTreeNodes)
  Alloc.deallocate(SpanningTreeNodes);
if (CFGNodes)
  Alloc.deallocate(CFGNodes);
936}

938void Graph::dump() const {
reportNumber("Dumping graph with number of nodes: ", NumNodes, 10);
report("  Full graph:\n");
for (int I = 0; I < NumNodes; ++I) {
  const Node *N = &CFGNodes[I];
  reportNumber("    Node #", I, 10);
  reportNumber("      InEdges total ", N->NumInEdges, 10);
  for (int J = 0; J < N->NumInEdges; ++J)
    reportNumber("        ", N->InEdges[J].Node, 10);
  reportNumber("      OutEdges total ", N->NumOutEdges, 10);
  for (int J = 0; J < N->NumOutEdges; ++J)
    reportNumber("        ", N->OutEdges[J].Node, 10);
  report("\n");
}
report("  Spanning tree:\n");
for (int I = 0; I < NumNodes; ++I) {
  const Node *N = &SpanningTreeNodes[I];
  reportNumber("    Node #", I, 10);
  reportNumber("      InEdges total ", N->NumInEdges, 10);
  for (int J = 0; J < N->NumInEdges; ++J)
    reportNumber("        ", N->InEdges[J].Node, 10);
  reportNumber("      OutEdges total ", N->NumOutEdges, 10);
  for (int J = 0; J < N->NumOutEdges; ++J)
    reportNumber("        ", N->OutEdges[J].Node, 10);
  report("\n");
}
964}

966void Graph::dumpEdgeFreqs() const {
reportNumber(
    "Dumping edge frequencies for graph with num edges: ", D.NumEdges, 10);
for (int I = 0; I < D.NumEdges; ++I) {
  reportNumber("* Src: ", D.Edges[I].FromNode, 10);
  reportNumber("  Dst: ", D.Edges[I].ToNode, 10);
  reportNumber("    Cnt: ", EdgeFreqs[I], 10);
}
974}

976/// Auxiliary map structure for fast lookups of which calls map to each node of
977/// the function CFG
978struct NodeToCallsMap {
struct MapEntry {
  uint32_t NumCalls;
  uint32_t *Calls;
};
MapEntry *Entries;
BumpPtrAllocator &Alloc;
const uint32_t NumNodes;

NodeToCallsMap(BumpPtrAllocator &Alloc, const FunctionDescription &D,
               uint32_t NumNodes)
    : Alloc(Alloc), NumNodes(NumNodes) {
  Entries = new (Alloc, 0) MapEntry[NumNodes];
  for (int I = 0; I < D.NumCalls; ++I) {
    DEBUG(reportNumber("Registering call in node ", D.Calls[I].FromNode, 10)){};
    ++Entries[D.Calls[I].FromNode].NumCalls;
  }
  for (int I = 0; I < NumNodes; ++I) {
    Entries[I].Calls = Entries[I].NumCalls ? new (Alloc)
                                                 uint32_t[Entries[I].NumCalls]
                                           : nullptr;
    Entries[I].NumCalls = 0;
  }
  for (int I = 0; I < D.NumCalls; ++I) {
    MapEntry &Entry = Entries[D.Calls[I].FromNode];
    Entry.Calls[Entry.NumCalls++] = I;
  }
}

/// Set the frequency of all calls in node \p NodeID to Freq. However, if
/// the calls have their own counters and do not depend on the basic block
/// counter, this means they have landing pads and throw exceptions. In this
/// case, set their frequency with their counters and return the maximum
/// value observed in such counters. This will be used as the new frequency
/// at basic block entry. This is used to fix the CFG edge frequencies in the
/// presence of exceptions.
uint64_t visitAllCallsIn(uint32_t NodeID, uint64_t Freq, uint64_t *CallFreqs,
                         const FunctionDescription &D,
                         const uint64_t *Counters,
                         ProfileWriterContext &Ctx) const {
  const MapEntry &Entry = Entries[NodeID];
  uint64_t MaxValue = 0ull;
  for (int I = 0, E = Entry.NumCalls; I != E; ++I) {
    const uint32_t CallID = Entry.Calls[I];
    DEBUG(reportNumber("  Setting freq for call ID: ", CallID, 10)){};
    const CallDescription &CallDesc = D.Calls[CallID];
    if (CallDesc.Counter == 0xffffffff) {
      CallFreqs[CallID] = Freq;
      DEBUG(reportNumber("  with : ", Freq, 10)){};
    } else {
      const uint64_t CounterVal = Counters[CallDesc.Counter];
      CallFreqs[CallID] = CounterVal;
      MaxValue = CounterVal > MaxValue ? CounterVal : MaxValue;
      DEBUG(reportNumber("  with (private counter) : ", CounterVal, 10)){};
    }
    DEBUG(reportNumber("  Address: 0x", CallDesc.TargetAddress, 16)){};
    if (CallFreqs[CallID] > 0)
      Ctx.CallFlowTable->get(CallDesc.TargetAddress).Calls +=
          CallFreqs[CallID];
  }
  return MaxValue;
}

~NodeToCallsMap() {
  for (int I = NumNodes - 1; I >= 0; --I)
    if (Entries[I].Calls)
      Alloc.deallocate(Entries[I].Calls);
  Alloc.deallocate(Entries);
}
1047};

1049/// Fill an array with the frequency of each edge in the function represented
1050/// by G, as well as another array for each call.
1051void Graph::computeEdgeFrequencies(const uint64_t *Counters,
                                 ProfileWriterContext &Ctx) {
if (NumNodes == 0)
  return;

EdgeFreqs = D.NumEdges ? new (Alloc, 0) uint64_t [D.NumEdges] : nullptr;
CallFreqs = D.NumCalls ? new (Alloc, 0) uint64_t [D.NumCalls] : nullptr;

// Setup a lookup for calls present in each node (BB)
NodeToCallsMap *CallMap = new (Alloc) NodeToCallsMap(Alloc, D, NumNodes);

// Perform a bottom-up, BFS traversal of the spanning tree in G. Edges in the
// spanning tree don't have explicit counters. We must infer their value using
// a linear combination of other counters (sum of counters of the outgoing
// edges minus sum of counters of the incoming edges).
uint32_t *Stack = new (Alloc) uint32_t [NumNodes];
uint32_t StackTop = 0;
enum Status : uint8_t { S_NEW = 0, S_VISITING, S_VISITED };
Status *Visited = new (Alloc, 0) Status[NumNodes];
uint64_t *LeafFrequency = new (Alloc, 0) uint64_t[NumNodes];
uint64_t *EntryAddress = new (Alloc, 0) uint64_t[NumNodes];

// Setup a fast lookup for frequency of leaf nodes, which have special
// basic block frequency instrumentation (they are not edge profiled).
for (int I = 0; I < D.NumLeafNodes; ++I) {
  LeafFrequency[D.LeafNodes[I].Node] = Counters[D.LeafNodes[I].Counter];
  DEBUG({{}
    if (Counters[D.LeafNodes[I].Counter] > 0) {{}
      reportNumber("Leaf Node# ", D.LeafNodes[I].Node, 10);{}
      reportNumber("     Counter: ", Counters[D.LeafNodes[I].Counter], 10);{}
    }{}
  }){};
}
for (int I = 0; I < D.NumEntryNodes; ++I) {
  EntryAddress[D.EntryNodes[I].Node] = D.EntryNodes[I].Address;
  DEBUG({{}
      reportNumber("Entry Node# ", D.EntryNodes[I].Node, 10);{}
      reportNumber("      Address: ", D.EntryNodes[I].Address, 16);{}
  }){};
}
// Add all root nodes to the stack
for (int I = 0; I < NumNodes; ++I)
  if (SpanningTreeNodes[I].NumInEdges == 0)
    Stack[StackTop++] = I;

// Empty stack?
if (StackTop == 0) {
  DEBUG(report("Empty stack!\n")){};
  Alloc.deallocate(EntryAddress);
  Alloc.deallocate(LeafFrequency);
  Alloc.deallocate(Visited);
  Alloc.deallocate(Stack);
  CallMap->~NodeToCallsMap();
  Alloc.deallocate(CallMap);
  if (CallFreqs)
    Alloc.deallocate(CallFreqs);
  if (EdgeFreqs)
    Alloc.deallocate(EdgeFreqs);
  EdgeFreqs = nullptr;
  CallFreqs = nullptr;
  return;
}
// Add all known edge counts, will infer the rest
for (int I = 0; I < D.NumEdges; ++I) {
  const uint32_t C = D.Edges[I].Counter;
  if (C == 0xffffffff) // inferred counter - we will compute its value
    continue;
  EdgeFreqs[I] = Counters[C];
}

while (StackTop > 0) {
  const uint32_t Cur = Stack[--StackTop];
  DEBUG({{}
    if (Visited[Cur] == S_VISITING){}
      report("(visiting) ");{}
    else{}
      report("(new) ");{}
    reportNumber("Cur: ", Cur, 10);{}
  }){};

  // This shouldn't happen in a tree
  assert(Visited[Cur] != S_VISITED, "should not have visited nodes in stack");
  if (Visited[Cur] == S_NEW) {
    Visited[Cur] = S_VISITING;
    Stack[StackTop++] = Cur;
    assert(StackTop <= NumNodes, "stack grew too large");
    for (int I = 0, E = SpanningTreeNodes[Cur].NumOutEdges; I < E; ++I) {
      const uint32_t Succ = SpanningTreeNodes[Cur].OutEdges[I].Node;
      Stack[StackTop++] = Succ;
      assert(StackTop <= NumNodes, "stack grew too large");
    }
    continue;
  }
  Visited[Cur] = S_VISITED;

  // Establish our node frequency based on outgoing edges, which should all be
  // resolved by now.
  int64_t CurNodeFreq = LeafFrequency[Cur];
  // Not a leaf?
  if (!CurNodeFreq) {
    for (int I = 0, E = CFGNodes[Cur].NumOutEdges; I != E; ++I) {
      const uint32_t SuccEdge = CFGNodes[Cur].OutEdges[I].ID;
      CurNodeFreq += EdgeFreqs[SuccEdge];
    }
  }
  if (CurNodeFreq < 0)
    CurNodeFreq = 0;

  const uint64_t CallFreq = CallMap->visitAllCallsIn(
      Cur, CurNodeFreq > 0 ? CurNodeFreq : 0, CallFreqs, D, Counters, Ctx);

  // Exception handling affected our output flow? Fix with calls info
  DEBUG({{}
    if (CallFreq > CurNodeFreq){}
      report("Bumping node frequency with call info\n");{}
  }){};
  CurNodeFreq = CallFreq > CurNodeFreq ? CallFreq : CurNodeFreq;

  if (CurNodeFreq > 0) {
    if (uint64_t Addr = EntryAddress[Cur]) {
      DEBUG({}
          reportNumber("  Setting flow at entry point address 0x", Addr, 16)){};
      DEBUG(reportNumber("  with: ", CurNodeFreq, 10)){};
      Ctx.CallFlowTable->get(Addr).Val = CurNodeFreq;
    }
  }

  // No parent? Reached a tree root, limit to call frequency updating.
  if (SpanningTreeNodes[Cur].NumInEdges == 0)
    continue;

  assert(SpanningTreeNodes[Cur].NumInEdges == 1, "must have 1 parent");
  const uint32_t Parent = SpanningTreeNodes[Cur].InEdges[0].Node;
  const uint32_t ParentEdge = SpanningTreeNodes[Cur].InEdges[0].ID;

  // Calculate parent edge freq.
  int64_t ParentEdgeFreq = CurNodeFreq;
  for (int I = 0, E = CFGNodes[Cur].NumInEdges; I != E; ++I) {
    const uint32_t PredEdge = CFGNodes[Cur].InEdges[I].ID;
    ParentEdgeFreq -= EdgeFreqs[PredEdge];
  }

  // Sometimes the conservative CFG that BOLT builds will lead to incorrect
  // flow computation. For example, in a BB that transitively calls the exit
  // syscall, BOLT will add a fall-through successor even though it should not
  // have any successors. So this block execution will likely be wrong. We
  // tolerate this imperfection since this case should be quite infrequent.
  if (ParentEdgeFreq < 0) {
    DEBUG(dumpEdgeFreqs()){};
    DEBUG(report("WARNING: incorrect flow")){};
    ParentEdgeFreq = 0;
  }
  DEBUG(reportNumber("  Setting freq for ParentEdge: ", ParentEdge, 10)){};
  DEBUG(reportNumber("  with ParentEdgeFreq: ", ParentEdgeFreq, 10)){};
  EdgeFreqs[ParentEdge] = ParentEdgeFreq;
}

Alloc.deallocate(EntryAddress);
Alloc.deallocate(LeafFrequency);
Alloc.deallocate(Visited);
Alloc.deallocate(Stack);
CallMap->~NodeToCallsMap();
Alloc.deallocate(CallMap);
DEBUG(dumpEdgeFreqs()){};
1215}

1217/// Write to \p FD all of the edge profiles for function \p FuncDesc. Uses
1218/// \p Alloc to allocate helper dynamic structures used to compute profile for
1219/// edges that we do not explictly instrument.
1220const uint8_t *writeFunctionProfile(int FD, ProfileWriterContext &Ctx,
                                  const uint8_t *FuncDesc,
                                  BumpPtrAllocator &Alloc) {
const FunctionDescription F(FuncDesc);
const uint8_t *next = FuncDesc + F.getSize();

1226#if !defined(__APPLE__)
uint64_t *bolt_instr_locations = __bolt_instr_locations;
1228#else
uint64_t *bolt_instr_locations = _bolt_instr_locations_getter();
1230#endif

// Skip funcs we know are cold
1233#ifndef ENABLE_DEBUG
uint64_t CountersFreq = 0;
for (int I = 0; I < F.NumLeafNodes; ++I)
  CountersFreq += bolt_instr_locations[F.LeafNodes[I].Counter];

if (CountersFreq == 0) {
  for (int I = 0; I < F.NumEdges; ++I) {
    const uint32_t C = F.Edges[I].Counter;
    if (C == 0xffffffff)
      continue;
    CountersFreq += bolt_instr_locations[C];
  }
  if (CountersFreq == 0) {
    for (int I = 0; I < F.NumCalls; ++I) {
      const uint32_t C = F.Calls[I].Counter;
      if (C == 0xffffffff)
        continue;
      CountersFreq += bolt_instr_locations[C];
    }
    if (CountersFreq == 0)
      return next;
  }
}
1256#endif

Graph *G = new (Alloc) Graph(Alloc, F, bolt_instr_locations, Ctx);
DEBUG(G->dump()){};

if (!G->EdgeFreqs && !G->CallFreqs) {
  G->~Graph();
  Alloc.deallocate(G);
  return next;
}

for (int I = 0; I < F.NumEdges; ++I) {
  const uint64_t Freq = G->EdgeFreqs[I];
  if (Freq == 0)
    continue;
  const EdgeDescription *Desc = &F.Edges[I];
  char LineBuf[BufSize];
  char *Ptr = LineBuf;
  Ptr = serializeLoc(Ctx, Ptr, Desc->From, BufSize);
  Ptr = serializeLoc(Ctx, Ptr, Desc->To, BufSize - (Ptr - LineBuf));
  Ptr = strCopy(Ptr, "0 ", BufSize - (Ptr - LineBuf) - 22);
  Ptr = intToStr(Ptr, Freq, 10);
  *Ptr++ = '\n';
  __write(FD, LineBuf, Ptr - LineBuf);
}

for (int I = 0; I < F.NumCalls; ++I) {
  const uint64_t Freq = G->CallFreqs[I];
  if (Freq == 0)
    continue;
  char LineBuf[BufSize];
  char *Ptr = LineBuf;
  const CallDescription *Desc = &F.Calls[I];
  Ptr = serializeLoc(Ctx, Ptr, Desc->From, BufSize);
  Ptr = serializeLoc(Ctx, Ptr, Desc->To, BufSize - (Ptr - LineBuf));
  Ptr = strCopy(Ptr, "0 ", BufSize - (Ptr - LineBuf) - 25);
  Ptr = intToStr(Ptr, Freq, 10);
  *Ptr++ = '\n';
  __write(FD, LineBuf, Ptr - LineBuf);
}

G->~Graph();
Alloc.deallocate(G);
return next;
1300}

1302#if !defined(__APPLE__)
1303const IndCallTargetDescription *
1304ProfileWriterContext::lookupIndCallTarget(uint64_t Target) const {
uint32_t B = 0;
uint32_t E = __bolt_instr_num_ind_targets;
if (E == 0)
  return nullptr;
do {
  uint32_t I = (E - B) / 2 + B;
  if (IndCallTargets[I].Address == Target)
    return &IndCallTargets[I];
  if (IndCallTargets[I].Address < Target)
    B = I + 1;
  else
    E = I;
} while (B < E);
return nullptr;
1319}

1321/// Write a single indirect call <src, target> pair to the fdata file
1322void visitIndCallCounter(IndirectCallHashTable::MapEntry &Entry,
                       int FD, int CallsiteID,
                       ProfileWriterContext *Ctx) {
if (Entry.Val == 0)
  return;
DEBUG(reportNumber("Target func 0x", Entry.Key, 16)){};
DEBUG(reportNumber("Target freq: ", Entry.Val, 10)){};
const IndCallDescription *CallsiteDesc =
    &Ctx->IndCallDescriptions[CallsiteID];
const IndCallTargetDescription *TargetDesc =
    Ctx->lookupIndCallTarget(Entry.Key);
if (!TargetDesc) {
  DEBUG(report("Failed to lookup indirect call target\n")){};
  char LineBuf[BufSize];
  char *Ptr = LineBuf;
  Ptr = serializeLoc(*Ctx, Ptr, *CallsiteDesc, BufSize);
  Ptr = strCopy(Ptr, "0 [unknown] 0 0 ", BufSize - (Ptr - LineBuf) - 40);
  Ptr = intToStr(Ptr, Entry.Val, 10);
  *Ptr++ = '\n';
  __write(FD, LineBuf, Ptr - LineBuf);
  return;
}
Ctx->CallFlowTable->get(TargetDesc->Address).Calls += Entry.Val;
char LineBuf[BufSize];
char *Ptr = LineBuf;
Ptr = serializeLoc(*Ctx, Ptr, *CallsiteDesc, BufSize);
Ptr = serializeLoc(*Ctx, Ptr, TargetDesc->Loc, BufSize - (Ptr - LineBuf));
Ptr = strCopy(Ptr, "0 ", BufSize - (Ptr - LineBuf) - 25);
Ptr = intToStr(Ptr, Entry.Val, 10);
*Ptr++ = '\n';
__write(FD, LineBuf, Ptr - LineBuf);
1353}

1355/// Write to \p FD all of the indirect call profiles.
1356void writeIndirectCallProfile(int FD, ProfileWriterContext &Ctx) {
for (int I = 0; I < __bolt_instr_num_ind_calls; ++I) {
  DEBUG(reportNumber("IndCallsite #", I, 10)){};
  GlobalIndCallCounters[I].forEachElement(visitIndCallCounter, FD, I, &Ctx);
}
1361}

1363/// Check a single call flow for a callee versus all known callers. If there are
1364/// less callers than what the callee expects, write the difference with source
1365/// [unknown] in the profile.
1366void visitCallFlowEntry(CallFlowHashTable::MapEntry &Entry, int FD,
                      ProfileWriterContext *Ctx) {
DEBUG(reportNumber("Call flow entry address: 0x", Entry.Key, 16)){};
DEBUG(reportNumber("Calls: ", Entry.Calls, 10)){};
DEBUG(reportNumber("Reported entry frequency: ", Entry.Val, 10)){};
DEBUG({{}
  if (Entry.Calls > Entry.Val){}
    report("  More calls than expected!\n");{}
}){};
if (Entry.Val <= Entry.Calls)
  return;
DEBUG(reportNumber({}
    "  Balancing calls with traffic: ", Entry.Val - Entry.Calls, 10)){};
const IndCallTargetDescription *TargetDesc =
    Ctx->lookupIndCallTarget(Entry.Key);
if (!TargetDesc) {
  // There is probably something wrong with this callee and this should be
  // investigated, but I don't want to assert and lose all data collected.
  DEBUG(report("WARNING: failed to look up call target!\n")){};
  return;
}
char LineBuf[BufSize];
char *Ptr = LineBuf;
Ptr = strCopy(Ptr, "0 [unknown] 0 ", BufSize);
Ptr = serializeLoc(*Ctx, Ptr, TargetDesc->Loc, BufSize - (Ptr - LineBuf));
Ptr = strCopy(Ptr, "0 ", BufSize - (Ptr - LineBuf) - 25);
Ptr = intToStr(Ptr, Entry.Val - Entry.Calls, 10);
*Ptr++ = '\n';
__write(FD, LineBuf, Ptr - LineBuf);
1395}

1397/// Open fdata file for writing and return a valid file descriptor, aborting
1398/// program upon failure.
1399int openProfile() {
// Build the profile name string by appending our PID
char Buf[BufSize];
char *Ptr = Buf;
uint64_t PID = __getpid();
Ptr = strCopy(Buf, __bolt_instr_filename, BufSize);
if (__bolt_instr_use_pid) {
  Ptr = strCopy(Ptr, ".", BufSize - (Ptr - Buf + 1));
  Ptr = intToStr(Ptr, PID, 10);
  Ptr = strCopy(Ptr, ".fdata", BufSize - (Ptr - Buf + 1));
}
*Ptr++ = '\0';
uint64_t FD = __open(Buf,
                     /*flags=*/0x241 /*O_WRONLY|O_TRUNC|O_CREAT*/,
                     /*mode=*/0666);
if (static_cast<int64_t>(FD) < 0) {
  report("Error while trying to open profile file for writing: ");
  report(Buf);
  reportNumber("\nFailed with error number: 0x",
               0 - static_cast<int64_t>(FD), 16);
  __exit(1);
}
return FD;
1422}

1424#endif

1426} // anonymous namespace

1428#if !defined(__APPLE__)

1430/// Reset all counters in case you want to start profiling a new phase of your
1431/// program independently of prior phases.
1432/// The address of this function is printed by BOLT and this can be called by
1433/// any attached debugger during runtime. There is a useful oneliner for gdb:
1434///
1435///   gdb -p $(pgrep -xo PROCESSNAME) -ex 'p ((void(*)())0xdeadbeef)()' \
1436///     -ex 'set confirm off' -ex quit
1437///
1438/// Where 0xdeadbeef is this function address and PROCESSNAME your binary file
1439/// name.
1440extern "C" void __bolt_instr_clear_counters() {
memset(reinterpret_cast<char *>(__bolt_instr_locations), 0,
       __bolt_num_counters * 8);
for (int I = 0; I < __bolt_instr_num_ind_calls; ++I)
  GlobalIndCallCounters[I].resetCounters();
1445}

1447/// This is the entry point for profile writing.
1448/// There are three ways of getting here:
1449///
1450///  * Program execution ended, finalization methods are running and BOLT
1451///    hooked into FINI from your binary dynamic section;
1452///  * You used the sleep timer option and during initialization we forked
1453///    a separete process that will call this function periodically;
1454///  * BOLT prints this function address so you can attach a debugger and
1455///    call this function directly to get your profile written to disk
1456///    on demand.
1457///
1458extern "C" void __attribute((force_align_arg_pointer))
1459__bolt_instr_data_dump() {
// Already dumping
if (!GlobalWriteProfileMutex->acquire())
4
←
Taking false branch→
  return;

BumpPtrAllocator HashAlloc;
HashAlloc.setMaxSize(0x6400000);
ProfileWriterContext Ctx = readDescriptions();
5
←
Calling 'readDescriptions'→
Ctx.CallFlowTable = new (HashAlloc, 0) CallFlowHashTable(HashAlloc);

DEBUG(printStats(Ctx)){};

int FD = openProfile();

BumpPtrAllocator Alloc;
const uint8_t *FuncDesc = Ctx.FuncDescriptions;
for (int I = 0, E = __bolt_instr_num_funcs; I < E; ++I) {
  FuncDesc = writeFunctionProfile(FD, Ctx, FuncDesc, Alloc);
  Alloc.clear();
  DEBUG(reportNumber("FuncDesc now: ", (uint64_t)FuncDesc, 16)){};
}
assert(FuncDesc == (void *)Ctx.Strings,
       "FuncDesc ptr must be equal to stringtable");

writeIndirectCallProfile(FD, Ctx);
Ctx.CallFlowTable->forEachElement(visitCallFlowEntry, FD, &Ctx);

__fsync(FD);
__close(FD);
__munmap(Ctx.MMapPtr, Ctx.MMapSize);
__close(Ctx.FileDesc);
HashAlloc.destroy();
GlobalWriteProfileMutex->release();
DEBUG(report("Finished writing profile.\n")){};
1493}

1495/// Event loop for our child process spawned during setup to dump profile data
1496/// at user-specified intervals
1497void watchProcess() {
timespec ts, rem;
uint64_t Ellapsed = 0ull;
uint64_t ppid;
if (__bolt_instr_wait_forks) {
  // Store parent pgid
  ppid = -__getpgid(0);
  // And leave parent process group
  __setpgid(0, 0);
} else {
  // Store parent pid
  ppid = __getppid();
  if (ppid == 1) {
    // Parent already dead
    __bolt_instr_data_dump();
    goto out;
  }
}

ts.tv_sec = 1;
ts.tv_nsec = 0;
while (1) {
  __nanosleep(&ts, &rem);
  // This means our parent process or all its forks are dead,
  // so no need for us to keep dumping.
  if (__kill(ppid, 0) < 0) {
    if (__bolt_instr_no_counters_clear)
      __bolt_instr_data_dump();
    break;
  }

  if (++Ellapsed < __bolt_instr_sleep_time)
    continue;

  Ellapsed = 0;
  __bolt_instr_data_dump();
  if (__bolt_instr_no_counters_clear == false)
    __bolt_instr_clear_counters();
}

1537out:;
DEBUG(report("My parent process is dead, bye!\n")){};
__exit(0);
1540}

1542extern "C" void __bolt_instr_indirect_call();
1543extern "C" void __bolt_instr_indirect_tailcall();

1545/// Initialization code
1546extern "C" void __attribute((force_align_arg_pointer)) __bolt_instr_setup() {
const uint64_t CountersStart =
    reinterpret_cast<uint64_t>(&__bolt_instr_locations[0]);
const uint64_t CountersEnd = alignTo(
    reinterpret_cast<uint64_t>(&__bolt_instr_locations[__bolt_num_counters]),
    0x1000);
DEBUG(reportNumber("replace mmap start: ", CountersStart, 16)){};
DEBUG(reportNumber("replace mmap stop: ", CountersEnd, 16)){};
assert (CountersEnd > CountersStart, "no counters");
// Maps our counters to be shared instead of private, so we keep counting for
// forked processes
__mmap(CountersStart, CountersEnd - CountersStart,
       0x3 /*PROT_READ|PROT_WRITE*/,
       0x31 /*MAP_ANONYMOUS | MAP_SHARED | MAP_FIXED*/, -1, 0);

__bolt_ind_call_counter_func_pointer = __bolt_instr_indirect_call;
__bolt_ind_tailcall_counter_func_pointer = __bolt_instr_indirect_tailcall;
// Conservatively reserve 100MiB shared pages
GlobalAlloc.setMaxSize(0x6400000);
GlobalAlloc.setShared(true);
GlobalWriteProfileMutex = new (GlobalAlloc, 0) Mutex();
if (__bolt_instr_num_ind_calls > 0)
  GlobalIndCallCounters =
      new (GlobalAlloc, 0) IndirectCallHashTable[__bolt_instr_num_ind_calls];

if (__bolt_instr_sleep_time != 0) {
  // Separate instrumented process to the own process group
  if (__bolt_instr_wait_forks)
    __setpgid(0, 0);

  if (long PID = __fork())
    return;
  watchProcess();
}
1580}

1582extern "C" __attribute((force_align_arg_pointer)) void
1583instrumentIndirectCall(uint64_t Target, uint64_t IndCallID) {
GlobalIndCallCounters[IndCallID].incrementVal(Target, GlobalAlloc);
1585}

1587/// We receive as in-stack arguments the identifier of the indirect call site
1588/// as well as the target address for the call
1589extern "C" __attribute((naked)) void __bolt_instr_indirect_call()
1590{
__asm__ __volatile__(SAVE_ALL"push %%rax\n" "push %%rbx\n" "push %%rcx\n" "push %%rdx\n" "push %%rdi\n"
 "push %%rsi\n" "push %%rbp\n" "push %%r8\n" "push %%r9\n" "push %%r10\n"
 "push %%r11\n" "push %%r12\n" "push %%r13\n" "push %%r14\n" "push %%r15\n"
 "sub $8, %%rsp\n"
                     "mov 0xa0(%%rsp), %%rdi\n"
                     "mov 0x98(%%rsp), %%rsi\n"
                     "call instrumentIndirectCall\n"
                     RESTORE_ALL"add $8, %%rsp\n" "pop %%r15\n" "pop %%r14\n" "pop %%r13\n" "pop %%r12\n"
 "pop %%r11\n" "pop %%r10\n" "pop %%r9\n" "pop %%r8\n" "pop %%rbp\n"
 "pop %%rsi\n" "pop %%rdi\n" "pop %%rdx\n" "pop %%rcx\n" "pop %%rbx\n"
 "pop %%rax\n"
                     "ret\n"
                     :::);
1598}

1600extern "C" __attribute((naked)) void __bolt_instr_indirect_tailcall()
1601{
__asm__ __volatile__(SAVE_ALL"push %%rax\n" "push %%rbx\n" "push %%rcx\n" "push %%rdx\n" "push %%rdi\n"
 "push %%rsi\n" "push %%rbp\n" "push %%r8\n" "push %%r9\n" "push %%r10\n"
 "push %%r11\n" "push %%r12\n" "push %%r13\n" "push %%r14\n" "push %%r15\n"
 "sub $8, %%rsp\n"
                     "mov 0x98(%%rsp), %%rdi\n"
                     "mov 0x90(%%rsp), %%rsi\n"
                     "call instrumentIndirectCall\n"
                     RESTORE_ALL"add $8, %%rsp\n" "pop %%r15\n" "pop %%r14\n" "pop %%r13\n" "pop %%r12\n"
 "pop %%r11\n" "pop %%r10\n" "pop %%r9\n" "pop %%r8\n" "pop %%rbp\n"
 "pop %%rsi\n" "pop %%rdi\n" "pop %%rdx\n" "pop %%rcx\n" "pop %%rbx\n"
 "pop %%rax\n"
                     "ret\n"
                     :::);
1609}

1611/// This is hooking ELF's entry, it needs to save all machine state.
1612extern "C" __attribute((naked)) void __bolt_instr_start()
1613{
__asm__ __volatile__(SAVE_ALL"push %%rax\n" "push %%rbx\n" "push %%rcx\n" "push %%rdx\n" "push %%rdi\n"
 "push %%rsi\n" "push %%rbp\n" "push %%r8\n" "push %%r9\n" "push %%r10\n"
 "push %%r11\n" "push %%r12\n" "push %%r13\n" "push %%r14\n" "push %%r15\n"
 "sub $8, %%rsp\n"
                     "call __bolt_instr_setup\n"
                     RESTORE_ALL"add $8, %%rsp\n" "pop %%r15\n" "pop %%r14\n" "pop %%r13\n" "pop %%r12\n"
 "pop %%r11\n" "pop %%r10\n" "pop %%r9\n" "pop %%r8\n" "pop %%rbp\n"
 "pop %%rsi\n" "pop %%rdi\n" "pop %%rdx\n" "pop %%rcx\n" "pop %%rbx\n"
 "pop %%rax\n"
                     "jmp __bolt_start_trampoline\n"
                     :::);
1619}

1621/// This is hooking into ELF's DT_FINI
1622extern "C" void __bolt_instr_fini() {
__bolt_fini_trampoline();
if (__bolt_instr_sleep_time == 0)
1
Assuming '__bolt_instr_sleep_time' is equal to 0→
2
←
Taking true branch→
  __bolt_instr_data_dump();
3
←
Calling '__bolt_instr_data_dump'→
DEBUG(report("Finished.\n")){};
1627}

1629#endif

1631#if defined(__APPLE__)

1633extern "C" void __bolt_instr_data_dump() {
ProfileWriterContext Ctx = readDescriptions();

int FD = 2;
BumpPtrAllocator Alloc;
const uint8_t *FuncDesc = Ctx.FuncDescriptions;
uint32_t bolt_instr_num_funcs = _bolt_instr_num_funcs_getter();

for (int I = 0, E = bolt_instr_num_funcs; I < E; ++I) {
  FuncDesc = writeFunctionProfile(FD, Ctx, FuncDesc, Alloc);
  Alloc.clear();
  DEBUG(reportNumber("FuncDesc now: ", (uint64_t)FuncDesc, 16)){};
}
assert(FuncDesc == (void *)Ctx.Strings,
       "FuncDesc ptr must be equal to stringtable");
1648}

1650// On OSX/iOS the final symbol name of an extern "C" function/variable contains
1651// one extra leading underscore: _bolt_instr_setup -> __bolt_instr_setup.
1652extern "C"
1653__attribute__((section("__TEXT,__setup")))
1654__attribute__((force_align_arg_pointer))
1655void _bolt_instr_setup() {
__asm__ __volatile__(SAVE_ALL"push %%rax\n" "push %%rbx\n" "push %%rcx\n" "push %%rdx\n" "push %%rdi\n"
 "push %%rsi\n" "push %%rbp\n" "push %%r8\n" "push %%r9\n" "push %%r10\n"
 "push %%r11\n" "push %%r12\n" "push %%r13\n" "push %%r14\n" "push %%r15\n"
 "sub $8, %%rsp\n" :::);

report("Hello!\n");

__asm__ __volatile__(RESTORE_ALL"add $8, %%rsp\n" "pop %%r15\n" "pop %%r14\n" "pop %%r13\n" "pop %%r12\n"
 "pop %%r11\n" "pop %%r10\n" "pop %%r9\n" "pop %%r8\n" "pop %%rbp\n"
 "pop %%rsi\n" "pop %%rdi\n" "pop %%rdx\n" "pop %%rcx\n" "pop %%rbx\n"
 "pop %%rax\n" :::);
1661}

1663extern "C"
1664__attribute__((section("__TEXT,__fini")))
1665__attribute__((force_align_arg_pointer))
1666void _bolt_instr_fini() {
report("Bye!\n");
__bolt_instr_data_dump();
1669}

1671#endif
1672#endif

←

/build/source/bolt/runtime/common.h

1	//===- bolt/runtime/common.h ------------------------------------- C++ --===//
2	//
3	// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4	// See https://llvm.org/LICENSE.txt for license information.
5	// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6	//
7	//===----------------------------------------------------------------------===//
8
9	#if !defined(__APPLE__)
10
11	#include <cstddef>
12	#include <cstdint>
13
14	#include "config.h"
15
16	#ifdef HAVE_ELF_H
17	#include <elf.h>
18	#endif
19
20	#else
21
22	typedef __SIZE_TYPE__long unsigned int size_t;
23	#define __SSIZE_TYPE__ \
24	__typeof__(_Generic((__SIZE_TYPE__long unsigned int)0, unsigned long long int \
25	: (long long int)0, unsigned long int \
26	: (long int)0, unsigned int \
27	: (int)0, unsigned short \
28	: (short)0, unsigned char \
29	: (signed char)0))
30	typedef __SSIZE_TYPE__ ssize_t;
31
32	typedef unsigned long long uint64_t;
33	typedef unsigned uint32_t;
34	typedef unsigned char uint8_t;
35
36	typedef long long int64_t;
37	typedef int int32_t;
38
39	#endif
40
41	// Save all registers while keeping 16B stack alignment
42	#define SAVE_ALL"push %%rax\n" "push %%rbx\n" "push %%rcx\n" "push %%rdx\n" "push %%rdi\n" "push %%rsi\n" "push %%rbp\n" "push %%r8\n" "push %%r9\n" "push %%r10\n" "push %%r11\n" "push %%r12\n" "push %%r13\n" "push %%r14\n" "push %%r15\n" "sub $8, %%rsp\n" \
43	"push %%rax\n" \
44	"push %%rbx\n" \
45	"push %%rcx\n" \
46	"push %%rdx\n" \
47	"push %%rdi\n" \
48	"push %%rsi\n" \
49	"push %%rbp\n" \
50	"push %%r8\n" \
51	"push %%r9\n" \
52	"push %%r10\n" \
53	"push %%r11\n" \
54	"push %%r12\n" \
55	"push %%r13\n" \
56	"push %%r14\n" \
57	"push %%r15\n" \
58	"sub $8, %%rsp\n"
59
60	// Mirrors SAVE_ALL
61	#define RESTORE_ALL"add $8, %%rsp\n" "pop %%r15\n" "pop %%r14\n" "pop %%r13\n" "pop %%r12\n" "pop %%r11\n" "pop %%r10\n" "pop %%r9\n" "pop %%r8\n" "pop %%rbp\n" "pop %%rsi\n" "pop %%rdi\n" "pop %%rdx\n" "pop %%rcx\n" "pop %%rbx\n" "pop %%rax\n" \
62	"add $8, %%rsp\n" \
63	"pop %%r15\n" \
64	"pop %%r14\n" \
65	"pop %%r13\n" \
66	"pop %%r12\n" \
67	"pop %%r11\n" \
68	"pop %%r10\n" \
69	"pop %%r9\n" \
70	"pop %%r8\n" \
71	"pop %%rbp\n" \
72	"pop %%rsi\n" \
73	"pop %%rdi\n" \
74	"pop %%rdx\n" \
75	"pop %%rcx\n" \
76	"pop %%rbx\n" \
77	"pop %%rax\n"
78
79	// Functions that are required by freestanding environment. Compiler may
80	// generate calls to these implicitly.
81	extern "C" {
82	void memcpy(void Dest, const void *Src, size_t Len) {
83	uint8_t d = static_cast<uint8_t >(Dest);
84	const uint8_t s = static_cast<const uint8_t >(Src);
85	while (Len--)
86	d++ = s++;
87	return Dest;
88	}
89
90	void memmove(void Dest, const void *Src, size_t Len) {
91	uint8_t d = static_cast<uint8_t >(Dest);
92	const uint8_t s = static_cast<const uint8_t >(Src);
93	if (d < s) {
94	while (Len--)
95	d++ = s++;
96	} else {
97	s += Len - 1;
98	d += Len - 1;
99	while (Len--)
100	d-- = s--;
101	}
102
103	return Dest;
104	}
105
106	void memset(void Buf, int C, size_t Size) {
107	char S = (char )Buf;
108	for (size_t I = 0; I < Size; ++I)
109	*S++ = C;
110	return Buf;
111	}
112
113	int memcmp(const void s1, const void s2, size_t n) {
114	const uint8_t c1 = static_cast<const uint8_t >(s1);
115	const uint8_t c2 = static_cast<const uint8_t >(s2);
116	for (; n--; c1++, c2++) {
117	if (c1 != c2)
118	return c1 < c2 ? -1 : 1;
119	}
120	return 0;
121	}
122	} // extern "C"
123
124	// Anonymous namespace covering everything but our library entry point
125	namespace {
126
127	constexpr uint32_t BufSize = 10240;
128
129	#define _STRINGIFY(x)"x" #x
130	#define STRINGIFY(x)"x" _STRINGIFY(x)"x"
131
132	uint64_t __read(uint64_t fd, const void *buf, uint64_t count) {
133	uint64_t ret;
134	#if defined(__APPLE__)
135	#define READ_SYSCALL0 0x2000003
136	#else
137	#define READ_SYSCALL0 0
138	#endif
139	__asm__ __volatile__("movq $" STRINGIFY(READ_SYSCALL)"0" ", %%rax\n"
140	"syscall\n"
141	: "=a"(ret)
142	: "D"(fd), "S"(buf), "d"(count)
143	: "cc", "rcx", "r11", "memory");
144	return ret;
145	}
146
147	uint64_t __write(uint64_t fd, const void *buf, uint64_t count) {
148	uint64_t ret;
149	#if defined(__APPLE__)
150	#define WRITE_SYSCALL1 0x2000004
151	#else
152	#define WRITE_SYSCALL1 1
153	#endif
154	__asm__ __volatile__("movq $" STRINGIFY(WRITE_SYSCALL)"1" ", %%rax\n"
155	"syscall\n"
156	: "=a"(ret)
157	: "D"(fd), "S"(buf), "d"(count)
158	: "cc", "rcx", "r11", "memory");
159	return ret;
160	}
161
162	void *__mmap(uint64_t addr, uint64_t size, uint64_t prot, uint64_t flags,
163	uint64_t fd, uint64_t offset) {
164	#if defined(__APPLE__)
165	#define MMAP_SYSCALL9 0x20000c5
166	#else
167	#define MMAP_SYSCALL9 9
168	#endif
169	void *ret;
170	register uint64_t r8 asm("r8") = fd;
171	register uint64_t r9 asm("r9") = offset;
172	register uint64_t r10 asm("r10") = flags;
173	__asm__ __volatile__("movq $" STRINGIFY(MMAP_SYSCALL)"9" ", %%rax\n"
174	"syscall\n"
175	: "=a"(ret)
176	: "D"(addr), "S"(size), "d"(prot), "r"(r10), "r"(r8),
177	"r"(r9)
178	: "cc", "rcx", "r11", "memory");
179	return ret;
180	}
181
182	uint64_t __munmap(void *addr, uint64_t size) {
183	#if defined(__APPLE__)
184	#define MUNMAP_SYSCALL11 0x2000049
185	#else
186	#define MUNMAP_SYSCALL11 11
187	#endif
188	uint64_t ret;
189	__asm__ __volatile__("movq $" STRINGIFY(MUNMAP_SYSCALL)"11" ", %%rax\n"
190	"syscall\n"
191	: "=a"(ret)
192	: "D"(addr), "S"(size)
193	: "cc", "rcx", "r11", "memory");
194	return ret;
195	}
196
197	#define SIG_BLOCK0 0
198	#define SIG_UNBLOCK1 1
199	#define SIG_SETMASK2 2
200
201	static const uint64_t MaskAllSignals[] = {-1ULL};
202
203	uint64_t __sigprocmask(int how, const void set, void oldset) {
204	#if defined(__APPLE__)
205	#define SIGPROCMASK_SYSCALL14 0x2000030
206	#else
207	#define SIGPROCMASK_SYSCALL14 14
208	#endif
209	uint64_t ret;
210	register long r10 asm("r10") = sizeof(uint64_t);
211	__asm__ __volatile__("movq $" STRINGIFY(SIGPROCMASK_SYSCALL)"14" ", %%rax\n"
212	"syscall\n"
213	: "=a"(ret)
214	: "D"(how), "S"(set), "d"(oldset), "r"(r10)
215	: "cc", "rcx", "r11", "memory");
216	return ret;
217	}
218
219	uint64_t __exit(uint64_t code) {
220	#if defined(__APPLE__)
221	#define EXIT_SYSCALL231 0x2000001
222	#else
223	#define EXIT_SYSCALL231 231
224	#endif
225	uint64_t ret;
226	__asm__ __volatile__("movq $" STRINGIFY(EXIT_SYSCALL)"231" ", %%rax\n"
227	"syscall\n"
228	: "=a"(ret)
229	: "D"(code)
230	: "cc", "rcx", "r11", "memory");
231	return ret;
232	}
233
234	// Helper functions for writing strings to the .fdata file. We intentionally
235	// avoid using libc names to make it clear it is our impl.
236
237	/// Write number Num using Base to the buffer in OutBuf, returns a pointer to
238	/// the end of the string.
239	char intToStr(char OutBuf, uint64_t Num, uint32_t Base) {
240	const char *Chars = "0123456789abcdef";
241	char Buf[21];
242	char *Ptr = Buf;
243	while (Num) {
244	Ptr++ = (Chars + (Num % Base));
245	Num /= Base;
246	}
247	if (Ptr == Buf) {
248	*OutBuf++ = '0';
249	return OutBuf;
250	}
251	while (Ptr != Buf)
252	OutBuf++ = --Ptr;
253
254	return OutBuf;
255	}
256
257	/// Copy Str to OutBuf, returns a pointer to the end of the copied string
258	char strCopy(char OutBuf, const char *Str, int32_t Size = BufSize) {
259	while (*Str) {
260	OutBuf++ = Str++;
261	if (--Size <= 0)
262	return OutBuf;
263	}
264	return OutBuf;
265	}
266
267	/// Compare two strings, at most Num bytes.
268	int strnCmp(const char Str1, const char Str2, size_t Num) {
269	while (Num && Str1 && (Str1 == *Str2)) {
270	Num--;
271	Str1++;
272	Str2++;
273	}
274	if (Num == 0)
275	return 0;
276	return (unsigned char )Str1 - (unsigned char )Str2;
277	}
278
279	uint32_t strLen(const char *Str) {
280	uint32_t Size = 0;
281	while (*Str++)
282	++Size;
283	return Size;
284	}
285
286	void strStr(const char const Haystack, const char *const Needle) {
287	int j = 0;
288
289	for (int i = 0; i < strLen(Haystack); i++) {
290	if (Haystack[i] == Needle[0]) {
291	for (j = 1; j < strLen(Needle); j++) {
292	if (Haystack[i + j] != Needle[j])
293	break;
294	}
295	if (j == strLen(Needle))
296	return (void *)&Haystack[i];
297	}
298	}
299	return nullptr;
300	}
301
302	void reportNumber(const char *Msg, uint64_t Num, uint32_t Base) {
303	char Buf[BufSize];
304	char *Ptr = Buf;
305	Ptr = strCopy(Ptr, Msg, BufSize - 23);
306	Ptr = intToStr(Ptr, Num, Base);
307	Ptr = strCopy(Ptr, "\n");
308	__write(2, Buf, Ptr - Buf);
309	}
310
311	void report(const char *Msg) { __write(2, Msg, strLen(Msg)); }
312
313	unsigned long hexToLong(const char *Str, char Terminator = '\0') {
314	unsigned long Res = 0;
315	while (*Str != Terminator) {
316	Res <<= 4;
317	if ('0' <= Str && Str <= '9')
318	Res += *Str++ - '0';
319	else if ('a' <= Str && Str <= 'f')
320	Res += *Str++ - 'a' + 10;
321	else if ('A' <= Str && Str <= 'F')
322	Res += *Str++ - 'A' + 10;
323	else
324	return 0;
325	}
326	return Res;
327	}
328
329	/// Starting from character at \p buf, find the longest consecutive sequence
330	/// of digits (0-9) and convert it to uint32_t. The converted value
331	/// is put into \p ret. \p end marks the end of the buffer to avoid buffer
332	/// overflow. The function \returns whether a valid uint32_t value is found.
333	/// \p buf will be updated to the next character right after the digits.
334	static bool scanUInt32(const char &Buf, const char End, uint32_t &Ret) {
335	uint64_t Result = 0;
336	const char *OldBuf = Buf;
337	while (Buf < End && ((Buf) >= '0' && (Buf) <= '9')) {
338	Result = Result * 10 + (*Buf) - '0';
339	++Buf;
340	}
341	if (OldBuf != Buf && Result <= 0xFFFFFFFFu) {
342	Ret = static_cast<uint32_t>(Result);
343	return true;
344	}
345	return false;
346	}
347
348	#if !defined(__APPLE__)
349	// We use a stack-allocated buffer for string manipulation in many pieces of
350	// this code, including the code that prints each line of the fdata file. This
351	// buffer needs to accomodate large function names, but shouldn't be arbitrarily
352	// large (dynamically allocated) for simplicity of our memory space usage.
353
354	// Declare some syscall wrappers we use throughout this code to avoid linking
355	// against system libc.
356	uint64_t __open(const char *pathname, uint64_t flags, uint64_t mode) {
357	uint64_t ret;
358	__asm__ __volatile__("movq $2, %%rax\n"
359	"syscall"
360	: "=a"(ret)
361	: "D"(pathname), "S"(flags), "d"(mode)
362	: "cc", "rcx", "r11", "memory");
363	return ret;
364	}
365
366	struct dirent {
367	unsigned long d_ino; /* Inode number */
368	unsigned long d_off; /* Offset to next linux_dirent */
369	unsigned short d_reclen; /* Length of this linux_dirent */
370	char d_name[]; /* Filename (null-terminated) */
371	/* length is actually (d_reclen - 2 -
372	offsetof(struct linux_dirent, d_name)) */
373	};
374
375	long __getdents(unsigned int fd, dirent *dirp, size_t count) {
376	long ret;
377	__asm__ __volatile__("movq $78, %%rax\n"
378	"syscall"
379	: "=a"(ret)
380	: "D"(fd), "S"(dirp), "d"(count)
381	: "cc", "rcx", "r11", "memory");
382	return ret;
383	}
384
385	uint64_t __readlink(const char pathname, char buf, size_t bufsize) {
386	uint64_t ret;
387	__asm__ __volatile__("movq $89, %%rax\n"
388	"syscall"
389	: "=a"(ret)
390	: "D"(pathname), "S"(buf), "d"(bufsize)
391	: "cc", "rcx", "r11", "memory");
392	return ret;
393	}
394
395	uint64_t __lseek(uint64_t fd, uint64_t pos, uint64_t whence) {
396	uint64_t ret;
397	__asm__ __volatile__("movq $8, %%rax\n"
398	"syscall\n"
399	: "=a"(ret)
400	: "D"(fd), "S"(pos), "d"(whence)
401	: "cc", "rcx", "r11", "memory");
402	return ret;
403	}
404
405	int __close(uint64_t fd) {
406	uint64_t ret;
407	__asm__ __volatile__("movq $3, %%rax\n"
408	"syscall\n"
409	: "=a"(ret)
410	: "D"(fd)
411	: "cc", "rcx", "r11", "memory");
412	return ret;
413	}
414
415	int __madvise(void *addr, size_t length, int advice) {
416	int ret;
417	__asm__ __volatile__("movq $28, %%rax\n"
418	"syscall\n"
419	: "=a"(ret)
420	: "D"(addr), "S"(length), "d"(advice)
421	: "cc", "rcx", "r11", "memory");
422	return ret;
423	}
424
425	#define _UTSNAME_LENGTH65 65
426
427	struct UtsNameTy {
428	char sysname[_UTSNAME_LENGTH65]; /* Operating system name (e.g., "Linux") */
429	char nodename[_UTSNAME_LENGTH65]; /* Name within "some implementation-defined
430	network" */
431	char release[_UTSNAME_LENGTH65]; /* Operating system release (e.g., "2.6.28") */
432	char version[_UTSNAME_LENGTH65]; /* Operating system version */
433	char machine[_UTSNAME_LENGTH65]; /* Hardware identifier */
434	char domainname[_UTSNAME_LENGTH65]; /* NIS or YP domain name */
435	};
436
437	int __uname(struct UtsNameTy *Buf) {
438	int Ret;
439	__asm__ __volatile__("movq $63, %%rax\n"
440	"syscall\n"
441	: "=a"(Ret)
442	: "D"(Buf)
443	: "cc", "rcx", "r11", "memory");
444	return Ret;
445	}
446
447	struct timespec {
448	uint64_t tv_sec; /* seconds */
449	uint64_t tv_nsec; /* nanoseconds */
450	};
451
452	uint64_t __nanosleep(const timespec req, timespec rem) {
453	uint64_t ret;
454	__asm__ __volatile__("movq $35, %%rax\n"
455	"syscall\n"
456	: "=a"(ret)
457	: "D"(req), "S"(rem)
458	: "cc", "rcx", "r11", "memory");
459	return ret;
460	}
461
462	int64_t __fork() {
463	uint64_t ret;
464	__asm__ __volatile__("movq $57, %%rax\n"
465	"syscall\n"
466	: "=a"(ret)
467	:
468	: "cc", "rcx", "r11", "memory");
469	return ret;
470	}
471
472	int __mprotect(void *addr, size_t len, int prot) {
473	int ret;
474	__asm__ __volatile__("movq $10, %%rax\n"
475	"syscall\n"
476	: "=a"(ret)
477	: "D"(addr), "S"(len), "d"(prot)
478	: "cc", "rcx", "r11", "memory");
479	return ret;
480	}
481
482	uint64_t __getpid() {
483	uint64_t ret;
484	__asm__ __volatile__("movq $39, %%rax\n"
485	"syscall\n"
486	: "=a"(ret)
487	:
488	: "cc", "rcx", "r11", "memory");
489	return ret;
490	}
491
492	uint64_t __getppid() {
493	uint64_t ret;
494	__asm__ __volatile__("movq $110, %%rax\n"
495	"syscall\n"
496	: "=a"(ret)
497	:
498	: "cc", "rcx", "r11", "memory");
499	return ret;
500	}
501
502	int __setpgid(uint64_t pid, uint64_t pgid) {
503	int ret;
504	__asm__ __volatile__("movq $109, %%rax\n"
505	"syscall\n"
506	: "=a"(ret)
507	: "D"(pid), "S"(pgid)
508	: "cc", "rcx", "r11", "memory");
509	return ret;
510	}
511
512	uint64_t __getpgid(uint64_t pid) {
513	uint64_t ret;
514	__asm__ __volatile__("movq $121, %%rax\n"
515	"syscall\n"
516	: "=a"(ret)
517	: "D"(pid)
518	: "cc", "rcx", "r11", "memory");
519	return ret;
520	}
521
522	int __kill(uint64_t pid, int sig) {
523	int ret;
524	__asm__ __volatile__("movq $62, %%rax\n"
525	"syscall\n"
526	: "=a"(ret)
527	: "D"(pid), "S"(sig)
528	: "cc", "rcx", "r11", "memory");
529	return ret;
530	}
531
532	int __fsync(int fd) {
533	int ret;
534	__asm__ __volatile__("movq $74, %%rax\n"
535	"syscall\n"
536	: "=a"(ret)
537	: "D"(fd)
538	: "cc", "rcx", "r11", "memory");
539	return ret;
540	}
541
542	// %rdi %rsi %rdx %r10 %r8
543	// sys_prctl int option unsigned unsigned unsigned unsigned
544	// long arg2 long arg3 long arg4 long arg5
545	int __prctl(int Option, unsigned long Arg2, unsigned long Arg3,
546	unsigned long Arg4, unsigned long Arg5) {
547	int Ret;
548	register long rdx asm("rdx") = Arg3;
549	register long r8 asm("r8") = Arg5;
550	register long r10 asm("r10") = Arg4;
551	__asm__ __volatile__("movq $157, %%rax\n"
552	"syscall\n"
553	: "=a"(Ret)
554	: "D"(Option), "S"(Arg2), "d"(rdx), "r"(r10), "r"(r8)
555	:);
556	return Ret;
557	}
558
559	#endif
560
561	void reportError(const char *Msg, uint64_t Size) {
562	__write(2, Msg, Size);
563	__exit(1);
564	}
565
566	void assert(bool Assertion, const char *Msg) {
567	if (Assertion)
568	return;
569	char Buf[BufSize];
570	char *Ptr = Buf;
571	Ptr = strCopy(Ptr, "Assertion failed: ");
572	Ptr = strCopy(Ptr, Msg, BufSize - 40);
573	Ptr = strCopy(Ptr, "\n");
574	reportError(Buf, Ptr - Buf);
575	}
576
577	class Mutex {
578	volatile bool InUse{false};
579
580	public:
581	bool acquire() { return !__atomic_test_and_set(&InUse, __ATOMIC_ACQUIRE2); }
582	void release() { __atomic_clear(&InUse, __ATOMIC_RELEASE3); }
583	};
584
585	/// RAII wrapper for Mutex
586	class Lock {
587	Mutex &M;
588	uint64_t SignalMask[1] = {};
589
590	public:
591	Lock(Mutex &M) : M(M) {
592	__sigprocmask(SIG_BLOCK0, MaskAllSignals, SignalMask);
593	while (!M.acquire()) {
594	}
595	}
596
597	~Lock() {
598	M.release();
599	__sigprocmask(SIG_SETMASK2, SignalMask, nullptr);
600	}
601	};
602
603	/// RAII wrapper for Mutex
604	class TryLock {
605	Mutex &M;
606	bool Locked = false;
607
608	public:
609	TryLock(Mutex &M) : M(M) {
610	int Retry = 100;
611	while (--Retry && !M.acquire())
612	;
613	if (Retry)
614	Locked = true;
615	}
616	bool isLocked() { return Locked; }
617
618	~TryLock() {
619	if (isLocked())
620	M.release();
621	}
622	};
623
624	inline uint64_t alignTo(uint64_t Value, uint64_t Align) {
625	return (Value + Align - 1) / Align * Align;
626	}
627
628	} // anonymous namespace