SANCOV(1)

💖 NAME 💖

sancov — manual page for sancov 11

---

🦋 DESCRIPTION 🦋

OVERVIEW: Sanitizer Coverage Processing Tool (sancov)

okay so bestie, this tool is literally the main character for extracting coverage-related info from: coverage-instrumented binary files, raw .sancov files and their symbolized .symcov version. Depending on chosen action the tool expects different input files:

• -print-coverage-pcs — coverage-instrumented binary files
• -print-coverage — .sancov files
• <other actions> — .sancov files & corresponding binary files, .symcov files

USAGE:

sancov [options] <action> <binary files...> <.sancov files...> <.symcov files...>

---

💅 OPTIONS 💅

🎨 Color Options 🎨

• --color — Use colors in output (default=autodetect). yes bestie, make it pop 💖

🌈 General options 🌈

• --aarch64-neon-syntax=<value> — Choose style of NEON code to emit from AArch64 backend:
  • =generic — Emit generic NEON assembly
  • =apple — Emit Apple-style NEON assembly
• --amdgpu-bypass-slow-div — skip the 64-bit divide for dynamic 32-bit values, bestie, it's giving speed 💅
• --amdgpu-disable-loop-alignment — do not align and prefetch loops, periodt
• --amdgpu-disable-power-sched — disable scheduling to minimize mAI power bursts, no cap
• --amdgpu-dpp-combine — enable DPP combiner, slay ✨
• --amdgpu-dump-hsa-metadata — dump AMDGPU HSA Metadata, iconic
• --amdgpu-enable-global-sgpr-addr — enable use of SGPR regs for GLOBAL LOAD/STORE instructions, fr fr
• --amdgpu-enable-merge-m0 — merge and hoist M0 initializations, lowkey useful
• --amdgpu-promote-alloca-to-vector-limit=<uint> — maximum byte size to consider promote alloca to vector, iykyk
• --amdgpu-reserve-vgpr-for-sgpr-spill — allocates one VGPR for future SGPR Spill, bestie
• --amdgpu-sdwa-peephole — enable SDWA peepholer, periodt
• --amdgpu-verify-hsa-metadata — verify AMDGPU HSA Metadata, no cap
• --amdgpu-vgpr-index-mode — use GPR indexing mode instead of movrel for vector indexing, it's giving efficiency
• --arm-add-build-attributes — (no description, just vibes 💅)
• --arm-implicit-it=<value> — allow conditional instructions outdside of an IT block, bestie
  • =always — accept in both ISAs, emit implicit ITs in Thumb
  • =never — warn in ARM, reject in Thumb
  • =arm — accept in ARM, reject in Thumb
  • =thumb — warn in ARM, emit implicit ITs in Thumb
• --atomic-counter-update-promoted — do counter update using atomic fetch add for promoted counters only, fr fr
• --atomic-first-counter — use atomic fetch add for first counter in a function (usually the entry counter), slay
• --blacklist=<string> — blacklist file (sanitizer blacklist format). periodt
• --bounds-checking-single-trap — use one trap block per function, no cap
• --cfg-hide-deoptimize-paths — (no description, bestie, it's giving mystery ✨)
• --cfg-hide-unreachable-paths — (no description, just vibes 💅)
• --cost-kind=<value> — target cost kind, iykyk
  • =throughput — reciprocal throughput
  • =latency — instruction latency
  • =code-size — code size

🎬 Action (required) 🎬

bestie, you literally have to pick one action, no cap.

• --print — print coverage addresses, bestie
• --print-coverage-pcs — print coverage instrumentation points addresses. periodt
• --covered-functions — print all covered funcions. (yes, funcions, we said what we said) 😭
• --not-covered-functions — print all not covered funcions. same energy 💀
• --print-coverage-stats — print coverage statistics. iconic
• --html-report — REMOVED. Use -symbolize & coverage-report-server.py. it's gone, bestie 🫶
• --symbolize — produces a symbolized JSON report from binary report. slay
• --merge — merges reports. no cap
• --cvp-dont-add-nowrap-flags — (no description, it's giving enigma 🫶)
• --debugify-level=<value> — kind of debug info to add, bestie
  • =locations — locations only
  • =location+variables — locations and Variables
• --debugify-quiet — suppress verbose debugify output, periodt
• --demangle — print demangled function name. fr fr
• --disable-promote-alloca-to-lds — disable promote alloca to LDS, no cap
• --disable-promote-alloca-to-vector — disable promote alloca to vector, slay
• --do-counter-promotion — do counter register promotion, iconic
• --emscripten-cxx-exceptions-allowed=<string> — the list of function names in which Emscripten-style exception handling is enabled (see emscripten EMSCRIPTEN_CATCHING_ALLOWED options), iykyk
• --enable-cse-in-irtranslator — should enable CSE in irtranslator, bestie
• --enable-cse-in-legalizer — should enable CSE in Legalizer, periodt
• --enable-emscripten-cxx-exceptions — WebAssembly Emscripten-style exception handling, no cap
• --enable-emscripten-sjlj — WebAssembly Emscripten-style setjmp/longjmp handling, slay
• --enable-gvn-hoist — enable the GVN hoisting pass (default = off), iconic
• --enable-gvn-memdep — (no description, just vibes 💅)
• --enable-gvn-sink — enable the GVN sinking pass (default = off), fr fr
• --enable-load-in-loop-pre — (no description, bestie, it's giving mystery ✨)
• --enable-load-pre — (no description, just vibes 💅)
• --enable-loop-simplifycfg-term-folding — (no description, it's giving enigma 🫶)
• --enable-name-compression — enable name/filename string compression, periodt
• --gpsize=<uint> — Global Pointer Addressing Size. The default size is 8. no cap
• --hash-based-counter-split — rename counter variable of a comdat function based on cfg hash, bestie
• --hot-cold-split — enable hot-cold splitting pass, slay
• --import-all-index — import all external functions in index. iconic
• --instcombine-code-sinking — enable code sinking, fr fr
• --instcombine-guard-widening-window=<uint> — how wide an instruction window to bypass looking for another guard, iykyk
• --instcombine-max-iterations=<uint> — limit the maximum number of instruction combining iterations, no cap
• --instcombine-max-num-phis=<uint> — maximum number phis to handle in intptr/ptrint folding, periodt
• --instcombine-maxarray-size=<uint> — maximum array size considered when doing a combine, bestie
• --instcombine-negator-enabled — should we attempt to sink negations? slay
• --instcombine-negator-max-depth=<uint> — what is the maximal lookup depth when trying to check for viability of negation sinking. iconic
• --instrprof-atomic-counter-update-all — make all profile counter updates atomic (for testing only), fr fr
• --internalize-public-api-file=<filename> — a file containing list of symbol names to preserve, no cap
• --internalize-public-api-list=<list> — a list of symbol names to preserve, periodt
• --iterative-counter-promotion — allow counter promotion across the whole loop nest. bestie
• --lto-embed-bitcode — embed LLVM bitcode in object files produced by LTO, slay
• --lto-pass-remarks-filter=<regex> — only record optimization remarks from passes whose names match the given regular expression, iconic
• --lto-pass-remarks-format=<format> — the format used for serializing remarks (default: YAML), fr fr
• --lto-pass-remarks-output=<filename> — output filename for pass remarks, no cap
• --matrix-default-layout=<value> — sets the default matrix layout, periodt
  • =column-major — use column-major layout
  • =row-major — use row-major layout
• --max-counter-promotions=<int> — max number of allowed counter promotions, bestie
• --max-counter-promotions-per-loop=<uint> — max number counter promotions per loop to avoid increasing register pressure too much, slay
• --memop-size-large=<uint> — set large value thresthold in memory intrinsic size profiling. Value of 0 disables the large value profiling. iconic
• --memop-size-range=<string> — set the range of size in memory intrinsic calls to be profiled precisely, in a format of <start_val>:<end_val>, fr fr
• --merror-missing-parenthesis — error for missing parenthesis around predicate registers, no cap
• --merror-noncontigious-register — error for register names that aren't contigious, periodt
• --mhvx — enable Hexagon Vector eXtensions, bestie
• --mhvx=<value> — enable Hexagon Vector eXtensions, slay
  • =v60 — build for HVX v60
  • =v62 — build for HVX v62
  • =v65 — build for HVX v65
  • =v66 — build for HVX v66
  • =v67 — build for HVX v67
• --mips-compact-branches=<value> — MIPS Specific: Compact branch policy. iconic
  • =never — do not use compact branches if possible.
  • =optimal — use compact branches where appropriate (default).
  • =always — always use compact branches if possible.
• --mips16-constant-islands — enable mips16 constant islands. fr fr
• --mips16-hard-float — enable mips16 hard float. no cap
• --mir-strip-debugify-only — should mir-strip-debug only strip debug info from debugified modules by default, periodt
• --mno-compound — disable looking for compound instructions for Hexagon, bestie
• --mno-fixup — disable fixing up resolved relocations for Hexagon, slay
• --mno-ldc1-sdc1 — bestie it EXPANDS those double precision loads and stores into their single precision counterparts 💅 no more double, we go small
• --mno-pairing — turns OFF the search for duplex instructions, Hexagon edition 🦋
• --mwarn-missing-parenthesis — yells at you when parenthesis is missing around predicate registers 😭
• --mwarn-noncontigious-register — warns when register names aren't contigious (yes, spelled exactly like that, iconic behavior, we keep it) ✨
• --mwarn-sign-mismatch — warns when a signed and unsigned value are mismatched, lowkey a vibe check for your types 💀
• --no-discriminators — disables generation of discriminator information, periodt 🎀
• --nvptx-sched4reg — NVPTX Specific: schedules for register pressue (again, the typo is the original, we do not fix, we respect) 👑
• --poison-checking-function-local — checks that returns are non-poison, and it's literally for testing 🧪
• --r600-ir-structurize — uses the StructurizeCFG IR pass 🌈
• --rdf-dump — no description given, she's mysterious, she's giving main character with no lore 🙈
• --rdf-limit=<uint> — also no description, equally cryptic, we love an enigma 💜
• --runtime-counter-relocation — enables relocating counters at runtime 🔥
• --safepoint-ir-verifier-print-only — no description, just vibes 🌸
• --sample-profile-check-record-coverage=<N> — emits a warning if less than N% of records in the input profile are matched to the IR 📊
• --sample-profile-check-sample-coverage=<N> — emits a warning if less than N% of samples in the input profile are matched to the IR 📊
• --sample-profile-max-propagate-iterations=<uint> — the maximum number of iterations to go through when propagating sample block/edge weights through the CFG 🔁
• --skip-dead-files — do NOT list dead source files in reports, she's ghosting them fr fr 👻
• --speculative-counter-promotion-max-exiting=<uint> — the max number of exiting blocks of a loop to allow speculative counter promotion 🚪
• --speculative-counter-promotion-to-loop — when this option is false, if the target block is in a loop, the promotion will be disallowed unless the promoted counter update can be further/iteratively promoted into an acyclic region 🔄
• --strip_path_prefix=<string> — strips this prefix from file paths in reports ✂️
• --summary-file=<string> — the summary file to use for function importing 📁
• --tail-predication=<value> — MVE tail-predication options, and she has LAYERS bestie:
  • =disabled — Don't tail-predicate loops
  • =enabled-no-reductions — Enable tail-predication, but not for reduction loops
  • =enabled — Enable tail-predication, including reduction loops
  • =force-enabled-no-reductions — Enable tail-predication, but not for reduction loops, and force this which might be unsafe
  • =force-enabled — Enable tail-predication, including reduction loops, and force this which might be unsafe

the force-enabled ones say might be unsafe right in the name, so like… she's telling you. read the label bestie 🚨

• --threads=<int> — no description, another mystery girl 💅
• --verify-region-info — verifies region info, and it is time consuming, so budget accordingly ⏳
• --vp-counters-per-site=<number> — the average number of profile counters allocated per value profiling site 🔢
• --vp-static-alloc — does static counter allocation for value profiler 🧮
• --x86-align-branch=<string> — specifies types of branches to align (plus separated list of types) ✨:
  • jcc — indicates conditional jumps
  • fused — indicates fused conditional jumps
  • jmp — indicates direct unconditional jumps
  • call — indicates direct and indirect calls
  • ret — indicates rets
  • indirect — indicates indirect unconditional jumps
• --x86-align-branch-boundary=<uint> — controls how the assembler should align branches with NOP. If the boundary's size is not 0, it should be a power of 2 and no less than 32. Branches will be aligned to prevent from being across or against the boundary of specified size. The default value 0 does not align branches 📐
• --x86-branches-within-32B-boundaries — aligns selected instructions to mitigate negative performance impact of Intel's micro code update for errata skx102 💀

May break assumptions about labels corresponding to particular instructions, and should be used with caution. so like, respectfully, be careful 🫶

• --x86-pad-max-prefix-size=<uint> — maximum number of prefixes to use for padding 🧷

---

🫶 Generic Options: 🫶

the universal girlies, every program has them, and honestly? we're obsessed

• --help — display available options (--help-hidden for more) 🌟
• --help-list — display list of available options (--help-list-hidden for more) 📜
• --version — display the version of this program 🏷️

---

🎀 Polly Options: Configure the polly loop optimizer 🎀

she's the loop optimizer and she is SO iconic for it

• --polly — enable the polly optimizer (only at -O3) 🔥
• --polly-2nd-level-tiling — enable a 2nd level loop of loop tiling 🧱
• --polly-ast-print-accesses — print memory access functions 👀
• --polly-context=<isl parameter set> — provide additional constraints on the context parameters 🎯
• --polly-dce-precise-steps=<int> — the number of precise steps between two approximating iterations. (A value of -1 schedules another approximation stage before the actual dead code elimination. 💀
• --polly-delicm-max-ops=<int> — maximum number of isl operations to invest for lifetime analysis; 0=no limit ♾️
• --polly-detect-full-functions — allow the detection of full functions 🕵️
• --polly-dump-after — dump module after Polly transformations into a file suffixed with "-after" 📤
• --polly-dump-after-file=<string> — dump module after Polly transformations to the given file 📁
• --polly-dump-before — dump module before Polly transformations into a file suffixed with "-before" 📥
• --polly-dump-before-file=<string> — dump module before Polly transformations to the given file 📁
• --polly-enable-simplify — simplify SCoP after optimizations ✨
• --polly-ignore-func=<string> — ignore functions that match a regex. Multiple regexes can be comma separated. Scop detection will ignore all functions that match ANY of the regexes provided. 🚫
• --polly-isl-arg=<argument> — option passed to ISL 🎁
• --polly-on-isl-error-abort — abort if an isl error is encountered 🛑
• --polly-only-func=<string> — only run on functions that match a regex. Multiple regexes can be comma separated. Scop detection will run on all functions that match ANY of the regexes provided. 🎯
• --polly-only-region=<identifier> — only run on certain regions (The provided identifier must appear in the name of the region's entry block 📍
• --polly-only-scop-detection — only run scop detection, but no other optimizations 🔍
• --polly-optimized-scops — Polly - Dump polyhedral description of Scops optimized with the isl scheduling optimizer and the set of post-scheduling transformations is applied on the schedule tree 🌳
• --polly-parallel — generate thread parallel code (isl codegen only) 🧵
• --polly-parallel-force — force generation of thread parallel code ignoring any cost model 💪
• --polly-pattern-matching-based-opts — perform optimizations based on pattern matching 🧩
• --polly-process-unprofitable — process scops that are unlikely to benefit from Polly optimizations. 🤷
• --polly-register-tiling — enable register tiling 🧱
• --polly-report — print information about the activities of Polly 📋
• --polly-show — highlight the code regions that will be optimized in a (CFG BBs and LLVM-IR instructions) 🌈
• --polly-show-only — highlight the code regions that will be optimized in a (CFG only BBs) 🎨
• --polly-stmt-granularity=<value> — algorithm to use for splitting basic blocks into multiple statements ✂️
  • =bb — One statement per basic block
  • =scalar-indep — Scalar independence heuristic
  • =store — Store-level granularity
• --polly-target=<value> — the hardware to target 🖥️
  • =cpu — generate CPU code
• --polly-tiling — enable loop tiling 🧱
• --polly-vectorizer=<value> — select the vectorization strategy 🎛️
  • =none — No Vectorization
  • =polly — Polly internal vectorizer
  • =stripmine — Strip-mine outer loops for the loop-vectorizer to trigger

---

okay bestie that's the whole page 💖 you read the entire thing, that's genuinely so impressive, i'm proud of you fr. this was sancov version 11, dated January 2022 — and if you ever need her again she's right there in the SANCOV(1) manual. go forth and slay 🫶✨