SANCOV(1)

📦
version 13.0.1 · 3 versions
, in ubuntu jammy

okay so bestie, welcome to sancov(1) — a User Command and honestly a whole LLVM-adjacent icon. 🎀 She is the Sanitizer Coverage Processing Tool, and yes she has a lot of options, and yes we are going to go through every single one of them, because that's what we do here. Grab a boba. 🧋

NAME

sancov — manual page for sancov 13. That's the name. Short, sweet, iconic. 💅

DESCRIPTION

OVERVIEW ✨

Sanitizer Coverage Processing Tool (sancov)

This tool can extract various coverage-related information from: coverage-instrumented binary files, raw .sancov files and their symbolized .symcov version. Depending on chosen action the tool expects different input files, and here's the receipts on which action wants what: 🔍

  • -print-coverage-pcs — coverage-instrumented binary files
  • -print-coverage — .sancov files
  • <other actions> — .sancov files & corresponding binary files, .symcov files

So like, feed her the right snack for the right job or she's just gonna stand there. 🍓

USAGE

sancov [options] <action> <binary files...> <.sancov files...> <.symcov files...>

Options first, then the action (required, we'll get to her), then your files. In that order. She's not flexible about it. 🙈

OPTIONS

Color Options 🎨

  • --color — Use colors in output (default=autodetect)

General options

Okay so this is the long part. Like, the long part. Every one of these lives here, no skips, no cuts. 👑

  • --aarch64-neon-syntax=<value> — Choose style of NEON code to emit from AArch64 backend:
    • =generic — Emit generic NEON assembly
    • =apple — Emit Apple-style NEON assembly
  • --aarch64-use-aa — Enable the use of AA during codegen.
  • --abort-on-max-devirt-iterations-reached — Abort when the max iterations for devirtualization CGSCC repeat pass is reached
  • --allow-ginsert-as-artifact — Allow G_INSERT to be considered an artifact. Hack around AMDGPU test infinite loops.
  • --amdgpu-bypass-slow-div — Skip 64-bit divide for dynamic 32-bit values
  • --amdgpu-disable-loop-alignment — Do not align and prefetch loops
  • --amdgpu-disable-power-sched — Disable scheduling to minimize mAI power bursts
  • --amdgpu-dpp-combine — Enable DPP combiner
  • --amdgpu-dump-hsa-metadata — Dump AMDGPU HSA Metadata
  • --amdgpu-enable-flat-scratch — Use flat scratch instructions
  • --amdgpu-enable-merge-m0 — Merge and hoist M0 initializations
  • --amdgpu-promote-alloca-to-vector-limit=<uint> — Maximum byte size to consider promote alloca to vector
  • --amdgpu-reserve-vgpr-for-sgpr-spill — Allocates one VGPR for future SGPR Spill
  • --amdgpu-sdwa-peephole — Enable SDWA peepholer
  • --amdgpu-use-aa-in-codegen — Enable the use of AA during codegen.
  • --amdgpu-verify-hsa-metadata — Verify AMDGPU HSA Metadata
  • --amdgpu-vgpr-index-mode — Use GPR indexing mode instead of movrel for vector indexing
  • --arm-add-build-attributes — no description on the page for this one, she's just there, mysterious and silent 🫥
  • --arm-implicit-it=<value> — Allow conditional instructions outdside of an IT block
    • =always — Accept in both ISAs, emit implicit ITs in Thumb
    • =never — Warn in ARM, reject in Thumb
    • =arm — Accept in ARM, reject in Thumb
    • =thumb — Warn in ARM, emit implicit ITs in Thumb
  • --asm-show-inst — Emit internal instruction representation to assembly file
  • --atomic-counter-update-promoted — Do counter update using atomic fetch add for promoted counters only
  • --atomic-first-counter — Use atomic fetch add for first counter in a function (usually the entry counter)
  • --blacklist=<string> — Blacklist file (sanitizer blacklist format).
  • --bounds-checking-single-trap — Use one trap block per function
  • --cfg-hide-cold-paths=<number> — Hide blocks with relative frequency below the given value
  • --cfg-hide-deoptimize-paths — no description given, just vibes 🫧
  • --cfg-hide-unreachable-paths — also no description given, also just vibes 🫧
  • --cost-kind=<value> — Target cost kind
    • =throughput — Reciprocal throughput
    • =latency — Instruction latency
    • =code-size — Code size
    • =size-latency — Code size and latency

Action (required) 🚨

Yes bestie, you have to pick one. This is the whole point of the tool. Don't skip her.

  • --print — Print coverage addresses
  • --print-coverage-pcs — Print coverage instrumentation points addresses.
  • --covered-functions — Print all covered funcions.
  • --not-covered-functions — Print all not covered funcions.
  • --print-coverage-stats — Print coverage statistics.
  • --html-report — REMOVED. Use -symbolize & coverage-report-server.py.
  • --symbolize — Produces a symbolized JSON report from binary report.
  • --merge — Merges reports.
⚠️ <red>Not me being the bearer of bad news but --html-report is REMOVED, okay? She's gone. If you want that, it's -symbolize plus coverage-report-server.py. Do not come for me, I'm just the messenger. 💀

General options (continued) 🦋

And we're back to the general options, because she wasn't done with you yet.

  • --debugify-level=<value> — Kind of debug info to add
    • =locations — Locations only
    • =location+variables — Locations and Variables
  • --debugify-quiet — Suppress verbose debugify output
  • --demangle — Print demangled function name.
  • --disable-i2p-p2i-opt — Disables inttoptr/ptrtoint roundtrip optimization
  • --disable-promote-alloca-to-lds — Disable promote alloca to LDS
  • --disable-promote-alloca-to-vector — Disable promote alloca to vector
  • --do-counter-promotion — Do counter register promotion
  • --dot-cfg-mssa=<file name for generated dot file> — file name for generated dot file
  • --dwarf-version=<int> — Dwarf version
  • --dwarf64 — Generate debugging info in the 64-bit DWARF format
  • --emscripten-cxx-exceptions-allowed=<string> — The list of function names in which Emscripten-style exception handling is enabled (see emscripten EMSCRIPTEN_CATCHING_ALLOWED options)
  • --enable-cse-in-irtranslator — Should enable CSE in irtranslator
  • --enable-cse-in-legalizer — Should enable CSE in Legalizer
  • --enable-emscripten-cxx-exceptions — WebAssembly Emscripten-style exception handling
  • --enable-emscripten-sjlj — WebAssembly Emscripten-style setjmp/longjmp handling
  • --enable-gvn-hoist — Enable the GVN hoisting pass (default = off)
  • --enable-gvn-memdep — no description on the page, she's keeping it to herself 🤫
  • --enable-gvn-sink — Enable the GVN sinking pass (default = off)
  • --enable-load-in-loop-pre — no description on the page 🌙
  • --enable-load-pre — no description on the page 🌙
  • --enable-loop-simplifycfg-term-folding — no description on the page 🌙
  • --enable-name-compression — Enable name/filename string compression
  • --enable-split-backedge-in-load-pre — no description on the page 🌙
  • --fatal-warnings — Treat warnings as errors
  • --force-opaque-pointers — Force all pointers to be opaque pointers
  • --gpsize=<uint> — Global Pointer Addressing Size. The default size is 8.
  • --hash-based-counter-split — Rename counter variable of a comdat function based on cfg hash
  • --hot-cold-split — Enable hot-cold splitting pass
  • --import-all-index — Import all external functions in index.
  • --incremental-linker-compatible — When used with filetype=obj, emit an object file which can be used with an incremental linker
  • --instcombine-code-sinking — Enable code sinking
  • --instcombine-guard-widening-window=<uint> — How wide an instruction window to bypass looking for another guard
  • --instcombine-max-iterations=<uint> — Limit the maximum number of instruction combining iterations
  • --instcombine-max-num-phis=<uint> — Maximum number phis to handle in intptr/ptrint folding
  • --instcombine-maxarray-size=<uint> — Maximum array size considered when doing a combine
  • --instcombine-negator-enabled — Should we attempt to sink negations?
  • --instcombine-negator-max-depth=<uint> — What is the maximal lookup depth when trying to check for viability of negation sinking.
  • --instrprof-atomic-counter-update-all — Make all profile counter updates atomic (for testing only)
  • --internalize-public-api-file=<filename> — A file containing list of symbol names to preserve
  • --internalize-public-api-list=<list> — A list of symbol names to preserve
  • --iterative-counter-promotion — Allow counter promotion across the whole loop nest.
  • --lto-embed-bitcode=<value> — Embed LLVM bitcode in object files produced by LTO
    • =none — Do not embed
    • =optimized — Embed after all optimization passes
    • =post-merge-pre-opt — Embed post merge, but before optimizations
  • --lto-pass-remarks-filter=<regex> — Only record optimization remarks from passes whose names match the given regular expression
  • --lto-pass-remarks-format=<format> — The format used for serializing remarks (default: YAML)
  • --lto-pass-remarks-output=<filename> — Output filename for pass remarks
  • --matrix-default-layout=<value> — Sets the default matrix layout
    • =column-major — Use column-major layout
    • =row-major — Use row-major layout
  • --max-counter-promotions=<int> — Max number of allowed counter promotions
  • --max-counter-promotions-per-loop=<uint> — Max number counter promotions per loop to avoid increasing register pressure too much
  • --mc-relax-all — When used with filetype=obj, relax all fixups in the emitted object file
And that's where part 1 lands, bestie — she keeps going. 💖
  • --merror-missing-parenthesis — throws an error when a parenthesis is missing around predicate registers. she does not let that slide 💅
  • --merror-noncontigious-register — errors out on register names that aren't contigious (yes, the original spells it like that, we don't gatekeep spelling here 🫶).
  • --mhvx — turn on Hexagon Vector eXtensions ✨
  • --mhvx=<value> — turn on Hexagon Vector eXtensions, but pick your flavor:
    • =v60 — Build for HVX v60
    • =v62 — Build for HVX v62
    • =v65 — Build for HVX v65
    • =v66 — Build for HVX v66
    • =v67 — Build for HVX v67
    • =v68 — Build for HVX v68
  • --mips-compact-branches=<value> — MIPS Specific: the compact branch policy, aka how much do we love compact branches 🎀
    • =never — Do not use compact branches if possible.
    • =optimal — Use compact branches where appropriate (default, bestie, this is the one you get for free).
    • =always — Always use compact branches if possible.
  • --mips16-constant-islands — Enable mips16 constant islands. 🏝️
  • --mips16-hard-float — Enable mips16 hard float.
  • --mir-strip-debugify-only — Should mir-strip-debug only strip debug info from debugified modules by default
  • --mno-compound — Disable looking for compound instructions for Hexagon
  • --mno-fixup — Disable fixing up resolved relocations for Hexagon
  • --mno-ldc1-sdc1 — Expand double precision loads and stores to their single precision counterparts
  • --mno-pairing — Disable looking for duplex instructions for Hexagon
  • --mwarn-missing-parenthesis — warn (not error, she's being nice) for missing parenthesis around predicate registers
  • --mwarn-noncontigious-register — warn for register names that arent contigious
  • --mwarn-sign-mismatch — warn for mismatching a signed and unsigned value 😭
  • --no-deprecated-warn — Suppress all deprecated warnings. the deprecated stuff is still deprecated though, this just shuts her up 💀
  • --no-discriminators — Disable generation of discriminator information.
  • --no-type-check — Suppress type errors (Wasm)
  • --no-warn — Suppress all warnings 🔇
  • --nvptx-sched4reg — NVPTX Specific: schedule for register pressue (yep, "pressue", that's how it's spelled in the original, no cap)
  • --poison-checking-function-local — Check that returns are non-poison (for testing)
  • --r600-ir-structurize — Use StructurizeCFG IR pass
  • --rdf-dump — no description given in the original, she's mysterious 🙈
  • --rdf-limit=<uint> — also no description. silence is a vibe 💅
  • --runtime-counter-relocation — Enable relocating counters at runtime.
  • --safepoint-ir-verifier-print-only — again, no description, we love an enigma ✨
  • --sample-profile-check-record-coverage=<N> — Emit a warning if less than N% of records in the input profile are matched to the IR.
  • --sample-profile-check-sample-coverage=<N> — Emit a warning if less than N% of samples in the input profile are matched to the IR.
  • --sample-profile-max-propagate-iterations=<uint> — Maximum number of iterations to go through when propagating sample block/edge weights through the CFG.
  • --skip-dead-files — Do not list dead source files in reports.
  • --skip-ret-exit-block — Suppress counter promotion if exit blocks contain ret.
  • --speculative-counter-promotion-max-exiting=<uint> — The max number of exiting blocks of a loop to allow speculative counter promotion
  • --speculative-counter-promotion-to-loop — When the option is false, if the target block is in a loop, the promotion will be disallowed unless the promoted counter update can be further/iteratively promoted into an acyclic region.
  • --strip_path_prefix=<string> — Strip this prefix from file paths in reports.
  • --summary-file=<string> — The summary file to use for function importing.
  • --tail-predication=<value> — MVE tail-predication pass options 🦋
    • =disabled — Don't tail-predicate loops
    • =enabled-no-reductions — Enable tail-predication, but not for reduction loops
    • =enabled — Enable tail-predication, including reduction loops
    • =force-enabled-no-reductions — Enable tail-predication, but not for reduction loops, and force this which might be unsafe ⚠️
    • =force-enabled — Enable tail-predication, including reduction loops, and force this which might be unsafe ⚠️
okay bestie, see the word unsafe twice up there? that's not decoration. that's the original talking. force at your own risk 🔥
  • --thinlto-assume-merged — Assume the input has already undergone ThinLTO function importing and the other pre-optimization pipeline changes.
  • --threads=<int> — no description in the original. she said "figure it out" 😌
  • --verify-region-info — Verify region info (time consuming) — she literally tells you it's slow, respect the honesty ⏳
  • --vp-counters-per-site=<number> — The average number of profile counters allocated per value profiling site.
  • --vp-static-alloc — Do static counter allocation for value profiler
  • --x86-align-branch=<string> — Specify types of branches to align (plus separated list of types):
    • jcc — indicates conditional jumps
    • fused — indicates fused conditional jumps
    • jmp — indicates direct unconditional jumps
    • call — indicates direct and indirect calls
    • ret — indicates rets
    • indirect — indicates indirect unconditional jumps
  • --x86-align-branch-boundary=<uint> — Control how the assembler should align branches with NOP. If the boundary's size is not 0, it should be a power of 2 and no less than 32. Branches will be aligned to prevent from being across or against the boundary of specified size. The default value 0 does not align branches.
  • --x86-branches-within-32B-boundaries — Align selected instructions to mitigate negative performance impact of Intel's micro code update for errata skx102. May break assumptions about labels corresponding to particular instructions, and should be used with caution.
⚠️ read that again: "May break assumptions about labels corresponding to particular instructions, and should be used with caution." that is a real warning from the real page, not me being dramatic (for once) 😭
  • --x86-pad-max-prefix-size=<uint> — Maximum number of prefixes to use for padding

✨ Generic Options ✨

the universal classics, everyone gets these 💖

  • --help — Display available options (--help-hidden for more)
  • --help-list — Display list of available options (--help-list-hidden for more)
  • --version — Display the version of this program

🦋 Polly Options: Configure the polly loop optimizer 🦋

she's the loop optimizer and she has OPINIONS 🌈

  • --polly — Enable the polly optimizer (with -O1, -O2 or -O3)
  • --polly-2nd-level-tiling — Enable a 2nd level loop of loop tiling
  • --polly-ast-print-accesses — Print memory access functions
  • --polly-context=<isl parameter set> — Provide additional constraints on the context parameters
  • --polly-dce-precise-steps=<int> — The number of precise steps between two approximating iterations. (A value of -1 schedules another approximation stage before the actual dead code elimination.
  • --polly-delicm-max-ops=<int> — Maximum number of isl operations to invest for lifetime analysis; 0=no limit
  • --polly-detect-full-functions — Allow the detection of full functions
  • --polly-dump-after — Dump module after Polly transformations into a file suffixed with "-after"
  • --polly-dump-after-file=<string> — Dump module after Polly transformations to the given file
  • --polly-dump-before — Dump module before Polly transformations into a file suffixed with "-before"
  • --polly-dump-before-file=<string> — Dump module before Polly transformations to the given file
  • --polly-enable-simplify — Simplify SCoP after optimizations
  • --polly-ignore-func=<string> — Ignore functions that match a regex. Multiple regexes can be comma separated. Scop detection will ignore all functions that match ANY of the regexes provided.
  • --polly-isl-arg=<argument> — Option passed to ISL
  • --polly-on-isl-error-abort — Abort if an isl error is encountered
  • --polly-only-func=<string> — Only run on functions that match a regex. Multiple regexes can be comma separated. Scop detection will run on all functions that match ANY of the regexes provided.
  • --polly-only-region=<identifier> — Only run on certain regions (The provided identifier must appear in the name of the region's entry block
  • --polly-only-scop-detection — Only run scop detection, but no other optimizations
  • --polly-optimized-scops — Polly - Dump polyhedral description of Scops optimized with the isl scheduling optimizer and the set of post-scheduling transformations is applied on the schedule tree
  • --polly-parallel — Generate thread parallel code (isl codegen only)
  • --polly-parallel-force — Force generation of thread parallel code ignoring any cost model
  • --polly-pattern-matching-based-opts — Perform optimizations based on pattern matching
  • --polly-pragma-based-opts — Apply user-directed transformation from metadata
  • --polly-process-unprofitable — Process scops that are unlikely to benefit from Polly optimizations.
  • --polly-register-tiling — Enable register tiling
  • --polly-report — Print information about the activities of Polly
  • --polly-show — bestie this one highlights the code regions that are gonna get optimized, and it's giving full glow-up energy in a (CFG BBs and LLVM-IR instructions) ✨ like it lights up the blocks and the IR instructions, no crumbs left
  • --polly-show-only — same sparkle, but lowkey more minimal: it highlights the code regions that will be optimized in a (CFG only BBs) 💅 so CFG only, we're not doing the IR this time
  • --polly-stmt-granularity=<value> — the algorithm to use for splitting basic blocks into multiple statements 🧚 pick your fighter:
    • =bb — one statement per basic block, periodt
    • =scalar-indep — the scalar independence heuristic, iykyk
    • =store — store-level granularity, obsessed
  • --polly-target=<value> — tells it the hardware to target 🎀
    • =cpu — generate CPU code, main character behavior fr fr
  • --polly-tiling — enable loop tiling 🔥 it's literally in the name and it's iconic
  • --polly-vectorizer=<value> — select the vectorization strategy 🌈 choose your vibe:
    • =none — no Vectorization, we're sitting this one out 💀
    • =polly — Polly internal vectorizer, the homegrown one 🫶
    • =stripmine — strip-mine outer loops for the loop-vectorizer to trigger, which is so smart of it ngl

and that's the whole page bestie, we ate and left zero crumbs 👑 this was sancov, version 13, dated July 2023, from the SANCOV(1) manual — go forth and instrument responsibly, mwah 💖🦋🌸

📦 where this page comes from