1 ===================================
2 Instrumentation Profile Format
3 ===================================
12 Clang supports two types of profiling via instrumentation [1]_: frontend-based
13 and IR-based, and both could support a variety of use cases [2]_ .
14 This document describes two binary serialization formats (raw and indexed) to
15 store instrumented profiles with a specific emphasis on IRPGO use case, in the
16 sense that when specific header fields and payload sections have different ways
17 of interpretation across use cases, the documentation is based on IRPGO.
20 Frontend-generated profiles are used together with coverage mapping for
21 `source-based code coverage`_. The `coverage mapping format`_ is different from
24 .. _`source-based code coverage`: https://clang.llvm.org/docs/SourceBasedCodeCoverage.html
25 .. _`coverage mapping format`: https://llvm.org/docs/CoverageMappingFormat.html
30 The raw profile is generated by running the instrumented binary. The raw profile
31 data from an executable or a shared library [3]_ consists of a header and
32 multiple sections, with each section as a memory dump. The raw profile data needs
33 to be reasonably compact and fast to generate.
35 There are no backward or forward version compatiblity guarantees for the raw profile
36 format. That is, compilers and tools `require`_ a specific raw profile version
37 to parse the profiles.
39 .. _`require`: https://github.com/llvm/llvm-project/blob/bffdde8b8e5d9a76a47949cd0f574f3ce656e181/llvm/lib/ProfileData/InstrProfReader.cpp#L551-L558
41 To feed profiles back into compilers for an optimized build (e.g., via
42 ``-fprofile-use`` for IR instrumentation), a raw profile must to be converted into
45 General Storage Layout
46 -----------------------
48 The storage layout of raw profile data format is illustrated below. Basically,
49 when the raw profile is read into an memory buffer, the actual byte offset of a
50 section is inferred from the section's order in the layout and size information
51 of all the sections ahead of it.
55 +----+-----------------------+
57 | +-----------------------+
59 | +-----------------------+
62 A +-----------------------+
65 R +-----------------------+
67 | +-----------------------+
70 +----+-----------------------+
72 A +-----------------------+
74 L +-----------------------+
76 A +-----------------------+
78 +----+-----------------------+
82 Sections might be padded to meet specific alignment requirements. For
83 simplicity, header fields and data sections solely for padding purpose are
84 omitted in the data layout graph above and the rest of this document.
90 Magic number encodes profile format (raw, indexed or text). For the raw format,
91 the magic number also encodes the endianness (big or little) and C pointer
92 size (4 or 8 bytes) of the platform on which the profile is generated.
94 A factory method reads the magic number to construct reader properly and returns
95 error upon unrecognized format. Specifically, the factory method and raw profile
96 reader implementation make sure that a raw profile file could be read back on
97 a platform with the opposite endianness and/or the other C pointer size.
100 The lower 32 bits specify the actual version and the most significant 32 bits
101 specify the variant types of the profile. IR-based instrumentation PGO and
102 context-sensitive IR-based instrumentation PGO are two variant types.
105 The byte size of `binary id`_ section.
108 The number of profile metadata. The byte size of `profile metadata`_ section
109 could be computed with this field.
112 The number of entries in the profile counter section. The byte size of `counter`_
113 section could be computed with this field.
116 The number of bytes in the profile `bitmap`_ section.
119 The number of bytes in the name section.
124 This field records the in-memory address difference between the `profile metadata`_
125 and counter section in the instrumented binary, i.e., ``start(__llvm_prf_cnts) - start(__llvm_prf_data)``.
127 It's used jointly with the `CounterPtr`_ field to compute the counter offset
128 relative to ``start(__llvm_prf_cnts)``. Check out calculation-of-counter-offset_
129 for a visualized explanation.
132 The ``__llvm_prf_data`` object file section might not be loaded into memory
133 when instrumented binary runs or might not get generated in the instrumented
134 binary in the first place. In those cases, ``CountersDelta`` is not used and
135 other mechanisms are used to match counters with instrumented code. See
136 `lightweight instrumentation`_ and `binary profile correlation`_ for examples.
139 This field records the in-memory address difference between the `profile metadata`_
140 and bitmap section in the instrumented binary, i.e., ``start(__llvm_prf_bits) - start(__llvm_prf_data)``.
142 It's used jointly with the `BitmapPtr`_ to find the bitmap of a profile data
143 record, in a similar way to how counters are referenced as explained by
144 calculation-of-counter-offset_ .
146 Similar to `CountersDelta`_ field, this field may not be used in non-PGO variants
150 Records the in-memory address of name section. Not used except for raw profile
151 reader error checking.
154 Records the number of instrumented vtable entries in the binary. Used for
158 Records the byte size in the virtual table names section. Used for `type profiling`_.
161 Records the number of value kinds. Macro `VALUE_PROF_KIND`_ defines the value
162 kinds with a description of the kind.
164 .. _`VALUE_PROF_KIND`: https://github.com/llvm/llvm-project/blob/7e405eb722e40c79b7726201d0f76b5dab34ba0f/compiler-rt/include/profile/InstrProfData.inc#L184-L186
171 Stores the binary ids of the instrumented binaries to associate binaries with
172 profiles for source code coverage. See `binary id`_ RFC for the design.
174 .. _`profile metadata`:
179 This section stores the metadata to map counters and value profiles back to
180 instrumented code regions (e.g., LLVM IR for IRPGO).
182 The in-memory representation of the metadata is `__llvm_profile_data`_.
183 Some fields are used to reference data from other sections in the profile.
184 The fields are documented as follows:
186 .. _`__llvm_profile_data`: https://github.com/llvm/llvm-project/blob/7c3b67d2038cfb48a80299089f6a1308eee1df7f/compiler-rt/include/profile/InstrProfData.inc#L65-L95
189 The MD5 of the function's PGO name. PGO name has the format
190 ``[<filepath><delimiter>]<mangled-name>`` where ``<filepath>`` and
191 ``<delimiter>`` are provided for local-linkage functions to tell possibly
197 A checksum of the function's IR, taking control flow graph and instrumented
198 value sites into accounts. See `computeCFGHash`_ for details.
200 .. _`computeCFGHash`: https://github.com/llvm/llvm-project/blob/7c3b67d2038cfb48a80299089f6a1308eee1df7f/llvm/lib/Transforms/Instrumentation/PGOInstrumentation.cpp#L616-L685
205 The in-memory address difference between profile data and the start of corresponding
206 counters. Counter position is stored this way (as a link-time constant) to reduce
207 instrumented binary size compared with snapshotting the address of symbols directly.
208 See `commit a1532ed`_ for further information.
210 .. _`commit a1532ed`: https://github.com/llvm/llvm-project/commit/a1532ed27582038e2d9588108ba0fe8237f01844
213 ``CounterPtr`` might represent a different value for non-IRPGO use case. For
214 example, for `binary profile correlation`_, it represents the absolute address of counter.
215 When in doubt, check source code.
220 The in-memory address difference between profile data and the start address of
221 corresponding bitmap.
224 Similar to `CounterPtr`_, this field may represent a different value for non-IRPGO use case.
227 Records the function address when instrumented binary runs. This is used to
228 map the profiled callee address of indirect calls to the ``NameRef`` during
229 conversion from raw to indexed profiles.
232 Represents value profiles in a two dimensional array. The number of elements
233 in the first dimension is the number of instrumented value sites across all
234 kinds. Each element in the first dimension is the head of a linked list, and
235 the each element in the second dimension is linked list element, carrying
236 ``<profiled-value, count>`` as payload. This is used by compiler runtime when
237 writing out value profiles.
240 Value profiling is supported by frontend and IR PGO instrumentation,
241 but it's not supported in all cases (e.g., `lightweight instrumentation`_).
244 The number of counters for the instrumented function.
247 This is an array of counters, and each counter represents the number of
248 instrumented sites for a kind of value in the function.
251 The number of bitmap bytes for the function.
258 For PGO [4]_, the counters within an instrumented function of a specific `FuncHash`_
259 are stored contiguously and in an order that is consistent with instrumentation points selection.
261 .. _calculation-of-counter-offset:
263 As mentioned above, the recorded counter offset is relative to the profile metadata.
264 So how are function counters located in the raw profile data?
266 Basically, the profile reader iterates profile metadata (from the `profile metadata`_
267 section) and makes use of the recorded relative distances, as illustrated below.
271 + --> start(__llvm_prf_data) --> +---------------------+ ------------+
273 | +---------------------+ =====|| |
275 | +---------------------+ || |
277 Counter| +---------------------+ || |
278 Delta | | Data N | || |
279 | +---------------------+ || | CounterPtr1
284 + --> start(__llvm_prf_cnts) --> +---------------------+ || |
286 +---------------------+ -----||----+
289 +---------------------+ ||
291 +---------------------+ =====||
294 +---------------------+
296 +---------------------+
299 +---------------------+
304 * The profile header records ``CounterDelta`` with the value as ``start(__llvm_prf_cnts) - start(__llvm_prf_data)``.
305 We will call it ``CounterDeltaInitVal`` below for convenience.
306 * For each profile data record ``ProfileDataN``, ``CounterPtr`` is recorded as
307 ``start(CounterN) - start(ProfileDataN)``, where ``ProfileDataN`` is the N-th
308 entry in ``__llvm_prf_data``, and ``CounterN`` represents the corresponding
311 Each time the reader advances to the next data record, it `updates`_ ``CounterDelta``
312 to minus the size of one ``ProfileData``.
314 .. _`updates`: https://github.com/llvm/llvm-project/blob/17ff25a58ee4f29816d932fdb75f0d305718069f/llvm/include/llvm/ProfileData/InstrProfReader.h#L439-L444
316 For the counter corresponding to the first data record, the byte offset
317 relative to the start of the counter section is calculated as ``CounterPtr1 - CounterDeltaInitVal``.
318 When profile reader advances to the second data record, note ``CounterDelta``
319 is updated to ``CounterDeltaInitVal - sizeof(ProfileData)``.
320 Thus the byte offset relative to the start of the counter section is calculated
321 as ``CounterPtr2 - (CounterDeltaInitVal - sizeof(ProfileData))``.
327 This section is used for source-based `Modified Condition/Decision Coverage`_ code coverage. Check out `Bitmap RFC`_
330 .. _`Modified Condition/Decision Coverage`: https://en.wikipedia.org/wiki/Modified_condition/decision_coverage
331 .. _`Bitmap RFC`: https://discourse.llvm.org/t/rfc-source-based-mc-dc-code-coverage/59244
333 .. _`function names`:
338 This section contains possibly compressed concatenated string of functions' PGO
339 names. If compressed, zlib library is used.
341 Function names serve as keys in the PGO data hash table when raw profiles are
342 converted into indexed profiles. They are also crucial for ``llvm-profdata`` to
343 show the profiles in a human-readable way.
345 Virtual Table Profile Data
346 ^^^^^^^^^^^^^^^^^^^^^^^^^^^
348 This section is used for `type profiling`_. Each entry corresponds to one virtual
349 table and is defined by the following C++ struct
353 struct VTableProfData {
354 // The start address of the vtable, collected at runtime.
355 uint64_t StartAddress;
356 // The byte size of the vtable. `StartAddress` and `ByteSize` specifies an address range to look up.
358 // The hash of vtable's (PGO) name
359 uint64_t MD5HashOfName;
362 At profile use time, the compiler looks up a profiled address in the sorted vtable
363 address ranges and maps the address to a specific vtable through hashed name.
368 This section is similar to `function names`_ section above, except it contains the PGO
369 names of profiled virtual tables. It's a standalone section such that raw profile
370 readers could directly find each name set by accessing the corresponding profile
373 This section is stored in raw profiles such that `llvm-profdata` could show the
374 profiles in a human-readable way.
379 This section contains the profile data for value profiling.
381 The value profiles corresponding to a profile metadata are serialized contiguously
382 as one record, and value profile records are stored in the same order as the
383 respective profile data, such that a raw profile reader `advances`_ the pointer to
384 profile data and the pointer to value profile records simutaneously [5]_ to find
385 value profiles for a per function, per `FuncHash`_ profile data.
387 .. _`advances`: https://github.com/llvm/llvm-project/blob/7e15fa9161eda7497a5d6abf0d951a1d12d86550/llvm/include/llvm/ProfileData/InstrProfReader.h#L456-L457
389 Indexed Profile Format
390 ===========================
392 Indexed profiles are generated from ``llvm-profdata``. In the indexed profiles,
393 function data are organized as on-disk hash table such that compilers can
394 look up profile data for functions in an IR module.
396 Compilers and tools must retain backward compatibility with indexed profiles.
397 That is, a tool or a compiler built at newer versions of code must understand
398 profiles generated by older tools or compilers.
400 General Storage Layout
401 -----------------------
403 The ASCII art depicts the general storage layout of indexed profiles.
404 Specifically, the indexed profile header describes the byte offset of individual
409 +-----------------------+---+
411 +-----------------------+ |
413 +-----------------------+ |
415 +-----------------------+ E
417 +------ | of section A | D
418 | +-----------------------+ E
420 +-----------| of section B | |
421 | | +-----------------------+ |
423 | | +-----------------------+ |
424 | | | Byte Offset | |
425 +---------------| of section Z | |
426 | | | +-----------------------+---+
427 | | | | Profile Summary | |
428 | | | +-----------------------+ P
429 | | +------>| Section A | A
430 | | +-----------------------+ Y
431 | +---------->| Section B | L
432 | +-----------------------+ O
434 | +-----------------------+ D
435 +-------------->| Section Z | |
436 +-----------------------+---+
440 Profile summary section is at the beginning of payload. It's right after the
441 header so its position is implicitly known after reading the header.
446 The `Header struct`_ is the source of truth and struct fields should explain
447 what's in the header. At a high level, `*Offset` fields record section byte
448 offsets, which are used by readers to locate interesting sections and skip
453 To maintain backward compatibility of the indexed profiles, existing fields
454 shouldn't be deleted from struct definition; the field order shouldn't be
455 modified. New fields should be appended.
457 .. _`Header struct`: https://github.com/llvm/llvm-project/blob/1a2960bab6381f2b288328e2371829b460ac020c/llvm/include/llvm/ProfileData/InstrProf.h#L1053-L1080
464 ^^^^^^^^^^^^^^^^^^^^^
465 This section is right after profile header. It stores the serialized profile
466 summary. For context-sensitive IR-based instrumentation PGO, this section stores
467 an additional profile summary corresponding to the context-sensitive profiles.
473 This section stores functions and their profiling data as an on-disk hash table.
474 Profile data for functions with the same name are grouped together and share one
475 hash table entry (the functions may come from different shared libraries for
476 instance). The profile data for them are organized as a sequence of key-value
477 pair where the key is `FuncHash`_, and the value is profiled information (represented
478 by `InstrProfRecord`_) for the function.
480 .. _`InstrProfRecord`: https://github.com/llvm/llvm-project/blob/7e405eb722e40c79b7726201d0f76b5dab34ba0f/llvm/include/llvm/ProfileData/InstrProf.h#L693
483 ^^^^^^^^^^^^^^^^^^^^^^
484 This section stores function's memory profiling data. See
485 `MemProf binary serialization format RFC`_ for the design.
487 .. _`MemProf binary serialization format RFC`: https://lists.llvm.org/pipermail/llvm-dev/2021-September/153007.html
490 ^^^^^^^^^^^^^^^^^^^^^^
491 The section is used to carry on `binary id`_ information from raw profiles.
493 Temporal Profile Traces
494 ^^^^^^^^^^^^^^^^^^^^^^^^
495 The section is used to carry on temporal profile information from raw profiles.
496 See `temporal profiling`_ for the design.
500 This section is used to store the names of vtables from raw profile in the indexed
503 Unlike function names which are stored as keys of `function data`_ hash table,
504 vtable names need to be stored in a standalone section in indexed profiles.
505 This way, `llvm-profdata` could show the profiled vtable information in a
509 =======================================
511 ``llvm-profdata`` is the command line tool to display and process instrumentation-
512 based profile data. For supported usages, check out `llvm-profdata documentation <https://llvm.org/docs/CommandGuide/llvm-profdata.html>`_.
514 .. [1] For usage, see https://clang.llvm.org/docs/UsersManual.html#profiling-with-instrumentation
515 .. [2] For example, IR-based instrumentation supports `lightweight instrumentation`_
516 and `temporal profiling`_. Frontend instrumentation could support `single-byte counters`_.
517 .. [3] A raw profile file could contain the concatenation of multiple raw
518 profiles, for example, from an executable and its shared libraries. Raw
519 profile reader could parse all raw profiles from the file correctly.
520 .. [4] The counter section is used by a few variant types (like temporal
521 profiling) and might have different semantics there.
522 .. [5] The step size of data pointer is the ``sizeof(ProfileData)``, and the step
523 size of value profile pointer is calcuated based on the number of collected
526 .. _`lightweight instrumentation`: https://groups.google.com/g/llvm-dev/c/r03Z6JoN7d4
527 .. _`temporal profiling`: https://discourse.llvm.org/t/rfc-temporal-profiling-extension-for-irpgo/68068
528 .. _`single-byte counters`: https://discourse.llvm.org/t/rfc-single-byte-counters-for-source-based-code-coverage/75685
529 .. _`binary profile correlation`: https://discourse.llvm.org/t/rfc-add-binary-profile-correlation-to-not-load-profile-metadata-sections-into-memory-at-runtime/74565
530 .. _`binary id`: https://lists.llvm.org/pipermail/llvm-dev/2021-June/151154.html
531 .. _`type profiling`: https://discourse.llvm.org/t/rfc-dynamic-type-profiling-and-optimizations-in-llvm/74600