[Compiler-rt][XRAY][MIPS] Support xray on mips/mipsel/mips64/mips64el

[slthakur]

Summary

Adds support for xray on mips/mipsel/mips64/mips64el.

Patches for llvm and clang:

• LLVM: https://reviews.llvm.org/D27697
• Clang : https://reviews.llvm.org/D27698

[sdardis]

lib/xray/xray_mips.cc

49–56

See my comments on D27697 on the assembly and saving of $gp. My apologies, I should have written those comments here. Also, shouldn't that jal be jalr $t9 ?

[slthakur]

Addressed review comments.

[slthakur]

Removed patching of instruction "addiu t9, t9, 44" as it was unnecessary since it will always be there at the end of the sled when xray instrumentation is enabled.

[dberris]

Thanks @slthakur -- I'll defer to @sdardis on the mips-specific parts of this. Please wait for his LGTM before landing.

[slthakur]

Adding mips64 support for xray along with this change since I have the patch ready.

[slthakur]

Addressed review comments.

[sdardis]

The sled has an issue in that it requires 64bit atomic operations to disable it. MIPS32 doesn't natively support such operations and MIPS64 would need alignment guarantees to perform a 64 bit write. Instead if we use a sled like this:

addiu sp, sp, -8                        ;create stack frame
nop                                     ;avoid the need for 64bit atomics.
sw ra, 4(sp)                            ;save return address
sw t9, 0(sp)                            ;save register t9
lui t9, <Upper half of address of TracingHook>
ori t9, t9, <Lower half of address of TracingHook>
jalr t9                                 ;call Tracing hook
addiu t0 , zero, #<function ID>         ;pass function id (delay slot)
lw t9, 0(sp)                            ;restore register t9
lw ra, 4(sp)                            ;restore return address
addiu sp, sp, 8                         ;delete stack frame

We can disable or re-enable the sled with a single 32 bit write by changing addiu sp, sp, -8 to b.

lib/xray/xray_mips.cc

28

That comment should be "LUI T9, (<Address> >> 16) & 0xffff

29

// ORI T9, T9, <Address> & 0xffff

31

That opcode is wrong for mips, it should be 0x240c0000. Disassembling the existing one shows the instruction to be "addiu $8, $zero, 0".

54–55

There needs to be a nop between the addiu and the sw ra, 4(sp)

59

You need an "lui t9, %hi(FunctionID)" here.

60

Likewise, change this to "ori t0, t0, %lo(FunctionID).

108–115

You can't achieve memory safety with any ordering of these atomic writes. If program executes the branch before the nop is written, the branch will be executed and the sw ra, 4(sp) will be executed in the delay slot.

Reverse the order and the program could enter the tracing functionality without having saved the ra register.

64 bit atomic writes are usually not available on MIPS, and we'd have to rely on OS intervention before the program enters the sled to perform an atomic write. See my above comment on the sled design.

lib/xray/xray_mips64.cc

32

That opcode is wrong here as well.

54–67

The comment here is wrong. It needs to be the MIPS64 version for stack manipulations, spills and reloads.

116–122

See my comments about the memory safety issue.

lib/xray/xray_trampoline_mips.S

24

.cpload needs to be wrapped in .set noreorder/.set reorder block.

25

"Save argument registers before doing any actual work" is clearer IMHO.

27

After this, save $ra to the stack, and write:

.cfi_cfa_offset 31, <stack pointer adjustment + offset of saved ra>

to get the correct cfi information, IIUC.

32–35

You can't access $f13, $f15 in no-oddsp mode. Instead, use sdc1 $f12 / sdc $f14 account for floating point arguments. That will handle both single and double precision cases.

37

There is no need to do this, as the .cpload macro has computed this object's gp pointer. We only need the gp pointer to compute the address of _ZN6__xray19XRayPatchedFunctionE's got entry, so there is no reason to save it.

This also applies to __xray_FunctionExit.

45

"move $a1, $zero" is clearer.

47

"move $a0, $t0" is clearer.

52

We don't need to restore gp here.

54–57

See my comment above about using sdc1, we need ldc $f12 / ldc $f14 here.

73–77

See my first two comments above about on the function entry prologue.

75

"Save return registers before doing any actual work" is clearer IMHO.

78–81

We need to save v0, v1, a0, a1 in the integer register set as they contain the return values.

82–85

We need to save $f0, $f2 in the floating point register set.

96

"move $a0, $t0"

103–110

These reloads need to match the spills above.

lib/xray/xray_trampoline_mips64.S

26–27

See my comments on the 32 bit version, This applies to most of them, so I'll highlight the MIPS64 specific differences.

31

For N64/N32 you also need to store $a4-$a7.

35

For N64/N32 you also have to save $f16-$f19.

54–61

The corresponding reloads are required.

78–87

For return values on N64/N32 we need to save $a0, $v0 for f128s on soft-float systems, $f0, $f1 for structs containing a long double, and $f0, $f2 for long doubles otherwise.

This is in addition the standard return registers.

[slthakur]

Addressed review comments

lib/xray/xray_mips.cc

31

We intend it to be "addiu $t0, $zero, 0" since we need to pass function id in register $t0 ($8 for MIPS32). But the opcode is surely wrong for the MIPS64 part, it should be 0x240C0000 because $t0 = $12 on MIPS64.

lib/xray/xray_mips64.cc

32

Changed it to 0x240C0000

[sdardis]

LGTM with nits addressed.

lib/xray/xray_mips.cc

109

You don't need to overwrite a nop with a nop.

lib/xray/xray_mips64.cc

109

You don't need to overwrite a nop with a nop.

lib/xray/xray_trampoline_mips.S

24–26

Formatting nit: alignment of the .set (no)reorders should match that of .cpload.

lib/xray/xray_trampoline_mips64.S

42–45

Nit: Formatting. Align the operands with the ones above.

[slthakur]

Addressed review comments.

[sdardis]

LGTM.

[slthakur]

Committed in revision 295166.
Thank you all for the review.

cmake/config-ix.cmake

set(ALL_PROFILE_SUPPORTED_ARCH ${X86} ${X86_64} ${ARM32} ${ARM64} ${PPC64}
     ${MIPS32} ${MIPS64} ${S390X})
 set(ALL_TSAN_SUPPORTED_ARCH ${X86_64} ${MIPS64} ${ARM64} ${PPC64})
 set(ALL_UBSAN_SUPPORTED_ARCH ${X86} ${X86_64} ${ARM32} ${ARM64}
     ${MIPS32} ${MIPS64} ${PPC64} ${S390X})
 set(ALL_SAFESTACK_SUPPORTED_ARCH ${X86} ${X86_64} ${ARM64} ${MIPS32} ${MIPS64})
 set(ALL_CFI_SUPPORTED_ARCH ${X86} ${X86_64} ${MIPS64})
 set(ALL_ESAN_SUPPORTED_ARCH ${X86_64} ${MIPS64})
 set(ALL_SCUDO_SUPPORTED_ARCH ${X86} ${X86_64} ${ARM32} ${ARM64})
-set(ALL_XRAY_SUPPORTED_ARCH ${X86_64} ${ARM32} ${ARM64})
+set(ALL_XRAY_SUPPORTED_ARCH ${X86_64} ${ARM32} ${ARM64} ${MIPS32} ${MIPS64})
 
 if(APPLE)
   include(CompilerRTDarwinUtils)
 
   find_darwin_sdk_dir(DARWIN_osx_SYSROOT macosx)
   find_darwin_sdk_dir(DARWIN_iossim_SYSROOT iphonesimulator)
   find_darwin_sdk_dir(DARWIN_ios_SYSROOT iphoneos)
   find_darwin_sdk_dir(DARWIN_watchossim_SYSROOT watchsimulator)

lib/xray/CMakeLists.txt

 set(armhf_SOURCES
   ${arm_SOURCES})
 
 set(aarch64_SOURCES
   xray_AArch64.cc
   xray_trampoline_AArch64.S
   ${XRAY_SOURCES})
 
+set(mips_SOURCES
+    xray_mips.cc
+    xray_trampoline_mips.S
+    ${XRAY_SOURCES})
+
+set(mipsel_SOURCES
+    xray_mips.cc
+    xray_trampoline_mips.S
+    ${XRAY_SOURCES})
+
+set(mips64_SOURCES
+    xray_mips64.cc
+    xray_trampoline_mips64.S
+    ${XRAY_SOURCES})
+
+set(mips64el_SOURCES
+    xray_mips64.cc
+    xray_trampoline_mips64.S
+    ${XRAY_SOURCES})
+
 include_directories(..)
 include_directories(../../include)
 
 set(XRAY_CFLAGS ${SANITIZER_COMMON_CFLAGS})
 set(XRAY_COMMON_DEFINITIONS XRAY_HAS_EXCEPTIONS=1)
 append_list_if(
   COMPILER_RT_HAS_XRAY_COMPILER_FLAG XRAY_SUPPORTED=1 XRAY_COMMON_DEFINITIONS)
 

lib/xray/tests/CMakeLists.txt

foreach(arch ${XRAY_TEST_ARCH})
         xray_compile(TEST_OBJECTS ${SOURCE} ${arch} ${TEST_HEADERS})
       endforeach()
       get_target_flags_for_arch(${arch} TARGET_LINK_FLAGS)
       set(TEST_DEPS ${TEST_OBJECTS})
       if(NOT COMPILER_RT_STANDALONE_BUILD)
         list(APPEND TEST_DEPS gtest_main xray)
       endif()
       if(NOT APPLE)
-        add_compiler_rt_test(XRayUnitTests ${testname}
+        add_compiler_rt_test(XRayUnitTests ${testname}-${arch}
           OBJECTS ${TEST_OBJECTS}
           DEPS ${TEST_DEPS}
           LINK_FLAGS ${TARGET_LINK_FLAGS}
           -lstdc++ -lm ${CMAKE_THREAD_LIBS_INIT}
           -lpthread
           -L${COMPILER_RT_LIBRARY_OUTPUT_DIR} -lclang_rt.xray-${arch}
           -latomic -ldl -lrt)
       endif()
       # FIXME: Figure out how to run even just the unit tests on APPLE.
     endforeach()
   endif()
 endmacro()
 
 if(COMPILER_RT_CAN_EXECUTE_TESTS)
   add_subdirectory(unit)
 endif()

lib/xray/xray_interface.cc

 #if defined(__x86_64__)
 // FIXME: The actual length is 11 bytes. Why was length 12 passed to mprotect()
 // ?
 static const int16_t cSledLength = 12;
 #elif defined(__aarch64__)
 static const int16_t cSledLength = 32;
 #elif defined(__arm__)
 static const int16_t cSledLength = 28;
+#elif SANITIZER_MIPS32
+static const int16_t cSledLength = 48;
+#elif SANITIZER_MIPS64
+static const int16_t cSledLength = 64;
 #else
 #error "Unsupported CPU Architecture"
 #endif /* CPU architecture */
 
 // This is the function to call when we encounter the entry or exit sleds.
 std::atomic<void (*)(int32_t, XRayEntryType)> XRayPatchedFunction{nullptr};
 
 // MProtectHelper is an RAII wrapper for calls to mprotect(...) that will undo

lib/xray/xray_mips.cc

+//===-- xray_mips.cc --------------------------------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of XRay, a dynamic runtime instrumentation system.
+//
+// Implementation of MIPS-specific routines (32-bit).
+//
+//===----------------------------------------------------------------------===//
+#include "sanitizer_common/sanitizer_common.h"
+#include "xray_defs.h"
+#include "xray_interface_internal.h"
+#include <atomic>
+
+namespace __xray {
+
+// The machine codes for some instructions used in runtime patching.
+enum PatchOpcodes : uint32_t {
+  PO_ADDIU = 0x24000000, // addiu rt, rs, imm
+  PO_SW = 0xAC000000,    // sw rt, offset(sp)
+  PO_LUI = 0x3C000000,   // lui rs, %hi(address)
+  PO_ORI = 0x34000000,   // ori rt, rs, %lo(address)
+  PO_JALR = 0x0000F809,  // jalr rs
+  PO_LW = 0x8C000000,    // lw rt, offset(address)
+  PO_B44 = 0x1000000b,   // b #44
+  PO_NOP = 0x0,          // nop
+};
+
+enum RegNum : uint32_t {
+  RN_T0 = 0x8,
+  RN_T9 = 0x19,
+  RN_RA = 0x1F,
+  RN_SP = 0x1D,
+};
+
+inline static uint32_t encodeInstruction(uint32_t Opcode, uint32_t Rs,
+                                         uint32_t Rt,
+                                         uint32_t Imm) XRAY_NEVER_INSTRUMENT {
+  return (Opcode | Rs << 21 | Rt << 16 | Imm);
+}
+
+inline static uint32_t
+encodeSpecialInstruction(uint32_t Opcode, uint32_t Rs, uint32_t Rt, uint32_t Rd,
+                         uint32_t Imm) XRAY_NEVER_INSTRUMENT {
+  return (Rs << 21 | Rt << 16 | Rd << 11 | Imm << 6 | Opcode);
+}
+
+inline static bool patchSled(const bool Enable, const uint32_t FuncId,
+                             const XRaySledEntry &Sled,
+                             void (*TracingHook)()) XRAY_NEVER_INSTRUMENT {
+  // When |Enable| == true,
+  // We replace the following compile-time stub (sled):
+  //
+  // xray_sled_n:
+  //  B .tmpN
+  //  11 NOPs (44 bytes)
+  //  .tmpN
+  //  ADDIU T9, T9, 44
+  //
+  // With the following runtime patch:
+  //
+  // xray_sled_n (32-bit):
+  //    addiu sp, sp, -8                        ;create stack frame
+  //    nop
+  //    sw ra, 4(sp)                            ;save return address
+  //    sw t9, 0(sp)                            ;save register t9
+  //    lui t9, %hi(__xray_FunctionEntry/Exit)
+  //    ori t9, t9, %lo(__xray_FunctionEntry/Exit)
+  //    lui t0, %hi(function_id)
+  //    jalr t9                                 ;call Tracing hook
+  //    ori t0, t0, %lo(function_id)            ;pass function id (delay slot)
+  //    lw t9, 0(sp)                            ;restore register t9
+  //    lw ra, 4(sp)                            ;restore return address
+  //    addiu sp, sp, 8                         ;delete stack frame
+  //
+  // We add 44 bytes to t9 because we want to adjust the function pointer to
+  // the actual start of function i.e. the address just after the noop sled.
+  // We do this because gp displacement relocation is emitted at the start of
+  // of the function i.e after the nop sled and to correctly calculate the
+  // global offset table address, t9 must hold the address of the instruction
+  // containing the gp displacement relocation.
+  // FIXME: Is this correct for the static relocation model?
+  //
+  // Replacement of the first 4-byte instruction should be the last and atomic
+  // operation, so that the user code which reaches the sled concurrently
+  // either jumps over the whole sled, or executes the whole sled when the
+  // latter is ready.
+  //
+  // When |Enable|==false, we set back the first instruction in the sled to be
+  //   B #44
+
+  if (Enable) {
+    uint32_t LoTracingHookAddr = reinterpret_cast<int32_t>(TracingHook) & 0xffff;
+    uint32_t HiTracingHookAddr =
+        (reinterpret_cast<int32_t>(TracingHook) >> 16) & 0xffff;
+    uint32_t LoFunctionID = FuncId & 0xffff;
+    uint32_t HiFunctionID = (FuncId >> 16) & 0xffff;
+    *reinterpret_cast<uint32_t *>(Sled.Address + 8) = encodeInstruction(
+        PatchOpcodes::PO_SW, RegNum::RN_SP, RegNum::RN_RA, 0x4);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 12) = encodeInstruction(
+        PatchOpcodes::PO_SW, RegNum::RN_SP, RegNum::RN_T9, 0x0);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 16) = encodeInstruction(
+        PatchOpcodes::PO_LUI, 0x0, RegNum::RN_T9, HiTracingHookAddr);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 20) = encodeInstruction(
+        PatchOpcodes::PO_ORI, RegNum::RN_T9, RegNum::RN_T9, LoTracingHookAddr);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 24) = encodeInstruction(
+        PatchOpcodes::PO_LUI, 0x0, RegNum::RN_T0, HiFunctionID);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 28) = encodeSpecialInstruction(
+        PatchOpcodes::PO_JALR, RegNum::RN_T9, 0x0, RegNum::RN_RA, 0X0);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 32) = encodeInstruction(
+        PatchOpcodes::PO_ORI, RegNum::RN_T0, RegNum::RN_T0, LoFunctionID);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 36) = encodeInstruction(
+        PatchOpcodes::PO_LW, RegNum::RN_SP, RegNum::RN_T9, 0x0);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 40) = encodeInstruction(
+        PatchOpcodes::PO_LW, RegNum::RN_SP, RegNum::RN_RA, 0x4);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 44) = encodeInstruction(
+        PatchOpcodes::PO_ADDIU, RegNum::RN_SP, RegNum::RN_SP, 0x8);
+    uint32_t CreateStackSpaceInstr = encodeInstruction(
+        PatchOpcodes::PO_ADDIU, RegNum::RN_SP, RegNum::RN_SP, 0xFFF8);
+    std::atomic_store_explicit(
+        reinterpret_cast<std::atomic<uint32_t> *>(Sled.Address),
+        uint32_t(CreateStackSpaceInstr), std::memory_order_release);
+  } else {
+    std::atomic_store_explicit(
+        reinterpret_cast<std::atomic<uint32_t> *>(Sled.Address),
+        uint32_t(PatchOpcodes::PO_B44), std::memory_order_release);
+  }
+  return true;
+}
+
+bool patchFunctionEntry(const bool Enable, const uint32_t FuncId,
+                        const XRaySledEntry &Sled) XRAY_NEVER_INSTRUMENT {
+  return patchSled(Enable, FuncId, Sled, __xray_FunctionEntry);
+}
+
+bool patchFunctionExit(const bool Enable, const uint32_t FuncId,
+                       const XRaySledEntry &Sled) XRAY_NEVER_INSTRUMENT {
+  return patchSled(Enable, FuncId, Sled, __xray_FunctionExit);
+}
+
+bool patchFunctionTailExit(const bool Enable, const uint32_t FuncId,
+                           const XRaySledEntry &Sled) XRAY_NEVER_INSTRUMENT {
+  // FIXME: In the future we'd need to distinguish between non-tail exits and
+  // tail exits for better information preservation.
+  return patchSled(Enable, FuncId, Sled, __xray_FunctionExit);
+}
+
+} // namespace __xray

lib/xray/xray_mips64.cc

+//===-- xray_mips64.cc ------------------------------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of XRay, a dynamic runtime instrumentation system.
+//
+// Implementation of MIPS64-specific routines.
+//
+//===----------------------------------------------------------------------===//
+#include "sanitizer_common/sanitizer_common.h"
+#include "xray_defs.h"
+#include "xray_interface_internal.h"
+#include <atomic>
+
+namespace __xray {
+
+// The machine codes for some instructions used in runtime patching.
+enum PatchOpcodes : uint32_t {
+  PO_DADDIU = 0x64000000, // daddiu rt, rs, imm
+  PO_SD = 0xFC000000,     // sd rt, base(offset)
+  PO_LUI = 0x3C000000,    // lui rt, imm
+  PO_ORI = 0x34000000,    // ori rt, rs, imm
+  PO_DSLL = 0x00000038,   // dsll rd, rt, sa
+  PO_JALR = 0x00000009,   // jalr rs
+  PO_LD = 0xDC000000,     // ld rt, base(offset)
+  PO_B60 = 0x1000000f,    // b #60
+  PO_NOP = 0x0,           // nop
+};
+
+enum RegNum : uint32_t {
+  RN_T0 = 0xC,
+  RN_T9 = 0x19,
+  RN_RA = 0x1F,
+  RN_SP = 0x1D,
+};
+
+inline static uint32_t encodeInstruction(uint32_t Opcode, uint32_t Rs,
+                                         uint32_t Rt,
+                                         uint32_t Imm) XRAY_NEVER_INSTRUMENT {
+  return (Opcode | Rs << 21 | Rt << 16 | Imm);
+}
+
+inline static uint32_t
+encodeSpecialInstruction(uint32_t Opcode, uint32_t Rs, uint32_t Rt, uint32_t Rd,
+                         uint32_t Imm) XRAY_NEVER_INSTRUMENT {
+  return (Rs << 21 | Rt << 16 | Rd << 11 | Imm << 6 | Opcode);
+}
+
+inline static bool patchSled(const bool Enable, const uint32_t FuncId,
+                             const XRaySledEntry &Sled,
+                             void (*TracingHook)()) XRAY_NEVER_INSTRUMENT {
+  // When |Enable| == true,
+  // We replace the following compile-time stub (sled):
+  //
+  // xray_sled_n:
+  //  B .tmpN
+  //  15 NOPs (60 bytes)
+  //  .tmpN
+  //
+  // With the following runtime patch:
+  //
+  // xray_sled_n (64-bit):
+  //    daddiu sp, sp, -16                      ;create stack frame
+  //    nop
+  //    sd ra, 8(sp)                            ;save return address
+  //    sd t9, 0(sp)                            ;save register t9
+  //    lui t9, %highest(__xray_FunctionEntry/Exit)
+  //    ori t9, t9, %higher(__xray_FunctionEntry/Exit)
+  //    dsll t9, t9, 16
+  //    ori t9, t9, %hi(__xray_FunctionEntry/Exit)
+  //    dsll t9, t9, 16
+  //    ori t9, t9, %lo(__xray_FunctionEntry/Exit)
+  //    lui t0, %hi(function_id)
+  //    jalr t9                                 ;call Tracing hook
+  //    ori t0, t0, %lo(function_id)            ;pass function id (delay slot)
+  //    ld t9, 0(sp)                            ;restore register t9
+  //    ld ra, 8(sp)                            ;restore return address
+  //    daddiu sp, sp, 16                       ;delete stack frame
+  //
+  // Replacement of the first 4-byte instruction should be the last and atomic
+  // operation, so that the user code which reaches the sled concurrently
+  // either jumps over the whole sled, or executes the whole sled when the
+  // latter is ready.
+  //
+  // When |Enable|==false, we set back the first instruction in the sled to be
+  //   B #60
+
+  if (Enable) {
+    uint32_t LoTracingHookAddr =
+        reinterpret_cast<int64_t>(TracingHook) & 0xffff;
+    uint32_t HiTracingHookAddr = (reinterpret_cast<int64_t>(TracingHook) >> 16) & 0xffff;
+    uint32_t HigherTracingHookAddr =
+        (reinterpret_cast<int64_t>(TracingHook) >> 32) & 0xffff;
+    uint32_t HighestTracingHookAddr =
+        (reinterpret_cast<int64_t>(TracingHook) >> 48) & 0xffff;
+    uint32_t LoFunctionID = FuncId & 0xffff;
+    uint32_t HiFunctionID = (FuncId >> 16) & 0xffff;
+    *reinterpret_cast<uint32_t *>(Sled.Address + 8) = encodeInstruction(
+        PatchOpcodes::PO_SD, RegNum::RN_SP, RegNum::RN_RA, 0x8);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 12) = encodeInstruction(
+        PatchOpcodes::PO_SD, RegNum::RN_SP, RegNum::RN_T9, 0x0);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 16) = encodeInstruction(
+        PatchOpcodes::PO_LUI, 0x0, RegNum::RN_T9, HighestTracingHookAddr);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 20) =
+        encodeInstruction(PatchOpcodes::PO_ORI, RegNum::RN_T9, RegNum::RN_T9,
+                          HigherTracingHookAddr);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 24) = encodeSpecialInstruction(
+        PatchOpcodes::PO_DSLL, 0x0, RegNum::RN_T9, RegNum::RN_T9, 0x10);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 28) = encodeInstruction(
+        PatchOpcodes::PO_ORI, RegNum::RN_T9, RegNum::RN_T9, HiTracingHookAddr);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 32) = encodeSpecialInstruction(
+        PatchOpcodes::PO_DSLL, 0x0, RegNum::RN_T9, RegNum::RN_T9, 0x10);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 36) = encodeInstruction(
+        PatchOpcodes::PO_ORI, RegNum::RN_T9, RegNum::RN_T9, LoTracingHookAddr);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 40) = encodeInstruction(
+        PatchOpcodes::PO_LUI, 0x0, RegNum::RN_T0, HiFunctionID);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 44) = encodeSpecialInstruction(
+        PatchOpcodes::PO_JALR, RegNum::RN_T9, 0x0, RegNum::RN_RA, 0X0);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 48) = encodeInstruction(
+        PatchOpcodes::PO_ORI, RegNum::RN_T0, RegNum::RN_T0, LoFunctionID);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 52) = encodeInstruction(
+        PatchOpcodes::PO_LD, RegNum::RN_SP, RegNum::RN_T9, 0x0);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 56) = encodeInstruction(
+        PatchOpcodes::PO_LD, RegNum::RN_SP, RegNum::RN_RA, 0x8);
+    *reinterpret_cast<uint32_t *>(Sled.Address + 60) = encodeInstruction(
+        PatchOpcodes::PO_DADDIU, RegNum::RN_SP, RegNum::RN_SP, 0x10);
+    uint32_t CreateStackSpace = encodeInstruction(
+        PatchOpcodes::PO_DADDIU, RegNum::RN_SP, RegNum::RN_SP, 0xfff0);
+    std::atomic_store_explicit(
+        reinterpret_cast<std::atomic<uint32_t> *>(Sled.Address),
+        CreateStackSpace, std::memory_order_release);
+  } else {
+    std::atomic_store_explicit(
+        reinterpret_cast<std::atomic<uint32_t> *>(Sled.Address),
+        uint32_t(PatchOpcodes::PO_B60), std::memory_order_release);
+  }
+  return true;
+}
+
+bool patchFunctionEntry(const bool Enable, const uint32_t FuncId,
+                        const XRaySledEntry &Sled) XRAY_NEVER_INSTRUMENT {
+  return patchSled(Enable, FuncId, Sled, __xray_FunctionEntry);
+}
+
+bool patchFunctionExit(const bool Enable, const uint32_t FuncId,
+                       const XRaySledEntry &Sled) XRAY_NEVER_INSTRUMENT {
+  return patchSled(Enable, FuncId, Sled, __xray_FunctionExit);
+}
+
+bool patchFunctionTailExit(const bool Enable, const uint32_t FuncId,
+                           const XRaySledEntry &Sled) XRAY_NEVER_INSTRUMENT {
+  // FIXME: In the future we'd need to distinguish between non-tail exits and
+  // tail exits for better information preservation.
+  return patchSled(Enable, FuncId, Sled, __xray_FunctionExit);
+}
+
+} // namespace __xray

lib/xray/xray_trampoline_mips.S

+//===-- xray_trampoline_mips.s ----------------------------------*- ASM -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of XRay, a dynamic runtime instrumentation system.
+//
+// This implements the MIPS-specific assembler for the trampolines.
+//
+//===----------------------------------------------------------------------===//
+
+  .text
+  .file "xray_trampoline_mips.S"
+  .globl __xray_FunctionEntry
+  .p2align 2
+  .type __xray_FunctionEntry,@function
+__xray_FunctionEntry:
+  .cfi_startproc
+  .set noreorder
+  .cpload $t9
+  .set reorder
+  // Save argument registers before doing any actual work
+  .cfi_def_cfa_offset 36
+  addiu  $sp, $sp, -36
+  sw     $ra, 32($sp)
+  .cfi_offset 31, -4
+  sw     $a3, 28($sp)
+  sw     $a2, 24($sp)
+  sw     $a1, 20($sp)
+  sw     $a0, 16($sp)
+  sdc1   $f14, 8($sp)
+  sdc1   $f12, 0($sp)
+
+  la     $t9, _ZN6__xray19XRayPatchedFunctionE
+  lw     $t9, 0($t9)
+
+  beqz   $t9, FunctionEntry_restore
+
+  // a1=0 means that we are tracing an entry event
+  move   $a1, $zero
+  // Function ID is in t0 (the first parameter).
+  move   $a0, $t0
+  jalr   $t9
+
+FunctionEntry_restore:
+  // Restore argument registers
+  ldc1   $f12, 0($sp)
+  ldc1   $f14, 8($sp)
+  lw     $a0, 16($sp)
+  lw     $a1, 20($sp)
+  lw     $a2, 24($sp)
+  lw     $a3, 28($sp)
+  lw     $ra, 32($sp)
+  addiu  $sp, $sp, 36
+  jr     $ra
+FunctionEntry_end:
+  .size __xray_FunctionEntry, FunctionEntry_end-__xray_FunctionEntry
+  .cfi_endproc
+
+  .text
+  .globl __xray_FunctionExit
+  .p2align 2
+  .type __xray_FunctionExit,@function
+__xray_FunctionExit:
+  .cfi_startproc
+  .set noreorder
+  .cpload $t9
+  .set reorder
+  // Save return registers before doing any actual work.
+  .cfi_def_cfa_offset 36
+  addiu  $sp, $sp, -36
+  sw     $ra, 32($sp)
+  .cfi_offset 31, -4
+  sw     $a1, 28($sp)
+  sw     $a0, 24($sp)
+  sw     $v1, 20($sp)
+  sw     $v0, 16($sp)
+  sdc1   $f2, 8($sp)
+  sdc1   $f0, 0($sp)
+
+  la     $t9, _ZN6__xray19XRayPatchedFunctionE
+  lw     $t9, 0($t9)
+
+  beqz   $t9, FunctionExit_restore
+
+  // a1=1 means that we are tracing an exit event
+  li     $a1, 1
+  // Function ID is in t0 (the first parameter).
+  move   $a0, $t0
+  jalr   $t9
+
+FunctionExit_restore:
+  // Restore return registers
+  ldc1   $f0, 0($sp)
+  ldc1   $f2, 8($sp)
+  lw     $v0, 16($sp)
+  lw     $v1, 20($sp)
+  lw     $a0, 24($sp)
+  lw     $a1, 28($sp)
+  lw     $ra, 32($sp)
+  addiu  $sp, $sp, 36
+  jr     $ra
+
+FunctionExit_end:
+  .size __xray_FunctionExit, FunctionExit_end-__xray_FunctionExit
+  .cfi_endproc

lib/xray/xray_trampoline_mips64.S

+//===-- xray_trampoline_mips64.s --------------------------------*- ASM -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of XRay, a dynamic runtime instrumentation system.
+//
+// This implements the MIPS64-specific assembler for the trampolines.
+//
+//===----------------------------------------------------------------------===//
+
+  .text
+  .file "xray_trampoline_mips64.S"
+  .globl __xray_FunctionEntry
+  .p2align 2
+  .type __xray_FunctionEntry,@function
+__xray_FunctionEntry:
+  .cfi_startproc
+  // Save argument registers before doing any actual work.
+  .cfi_def_cfa_offset 144
+  daddiu  $sp, $sp, -144
+  sd      $ra, 136($sp)
+  .cfi_offset 31, -8
+  sd      $gp, 128($sp)
+  sd      $a7, 120($sp)
+  sd      $a6, 112($sp)
+  sd      $a5, 104($sp)
+  sd      $a4, 96($sp)
+  sd      $a3, 88($sp)
+  sd      $a2, 80($sp)
+  sd      $a1, 72($sp)
+  sd      $a0, 64($sp)
+  sdc1    $f19, 56($sp)
+  sdc1    $f18, 48($sp)
+  sdc1    $f17, 40($sp)
+  sdc1    $f16, 32($sp)
+  sdc1    $f15, 24($sp)
+  sdc1    $f14, 16($sp)
+  sdc1    $f13, 8($sp)
+  sdc1    $f12, 0($sp)
+
+  lui     $gp, %hi(%neg(%gp_rel(__xray_FunctionEntry)))
+  daddu   $gp, $gp, $t9
+  daddiu  $gp ,$gp, %lo(%neg(%gp_rel(__xray_FunctionEntry)))
+
+  dla     $t9, _ZN6__xray19XRayPatchedFunctionE
+  ld      $t9, 0($t9)
+
+  beqz    $t9, FunctionEntry_restore
+
+  // a1=0 means that we are tracing an entry event
+  move    $a1, $zero
+  // Function ID is in t0 (the first parameter).
+  move    $a0, $t0
+  jalr    $t9
+
+FunctionEntry_restore:
+  // Restore argument registers
+  ldc1    $f12, 0($sp)
+  ldc1    $f13, 8($sp)
+  ldc1    $f14, 16($sp)
+  ldc1    $f15, 24($sp)
+  ldc1    $f16, 32($sp)
+  ldc1    $f17, 40($sp)
+  ldc1    $f18, 48($sp)
+  ldc1    $f19, 56($sp)
+  ld      $a0, 64($sp)
+  ld      $a1, 72($sp)
+  ld      $a2, 80($sp)
+  ld      $a3, 88($sp)
+  ld      $a4, 96($sp)
+  ld      $a5, 104($sp)
+  ld      $a6, 112($sp)
+  ld      $a7, 120($sp)
+  ld      $gp, 128($sp)
+  ld      $ra, 136($sp)
+  daddiu  $sp, $sp, 144
+  jr      $ra
+FunctionEntry_end:
+  .size __xray_FunctionEntry, FunctionEntry_end-__xray_FunctionEntry
+  .cfi_endproc
+
+  .text
+  .globl __xray_FunctionExit
+  .p2align 2
+  .type __xray_FunctionExit,@function
+__xray_FunctionExit:
+  .cfi_startproc
+  // Save return registers before doing any actual work.
+  .cfi_def_cfa_offset 64
+  daddiu  $sp, $sp, -64
+  sd      $ra, 56($sp)
+  .cfi_offset 31, -8
+  sd      $gp, 48($sp)
+  sd      $a0, 40($sp)
+  sd      $v1, 32($sp)
+  sd      $v0, 24($sp)
+  sdc1    $f2, 16($sp)
+  sdc1    $f1, 8($sp)
+  sdc1    $f0, 0($sp)
+
+  lui     $gp, %hi(%neg(%gp_rel(__xray_FunctionExit)))
+  daddu   $gp, $gp, $t9
+  daddiu  $gp ,$gp, %lo(%neg(%gp_rel(__xray_FunctionExit)))
+
+  dla     $t9, _ZN6__xray19XRayPatchedFunctionE
+  ld      $t9, 0($t9)
+
+  beqz    $t9, FunctionExit_restore
+
+  // a1=1 means that we are tracing an exit event
+  li      $a1, 1
+  // Function ID is in t0 (the first parameter).
+  move    $a0, $t0
+  jalr    $t9
+
+FunctionExit_restore:
+  // Restore return registers
+  ldc1    $f0, 0($sp)
+  ldc1    $f1, 8($sp)
+  ldc1    $f2, 16($sp)
+  ld      $v0, 24($sp)
+  ld      $v1, 32($sp)
+  ld      $a0, 40($sp)
+  ld      $gp, 48($sp)
+  ld      $ra, 56($sp)
+  daddiu  $sp, $sp, 64
+  jr      $ra
+
+FunctionExit_end:
+  .size __xray_FunctionExit, FunctionExit_end-__xray_FunctionExit
+  .cfi_endproc

lib/xray/xray_tsc.h

 // This file is a part of XRay, a dynamic runtime instrumentation system.
 //
 //===----------------------------------------------------------------------===//
 #ifndef XRAY_EMULATE_TSC_H
 #define XRAY_EMULATE_TSC_H
 
 #if defined(__x86_64__)
 #include "xray_x86_64.inc"
-#elif defined(__arm__) || defined(__aarch64__)
+#elif defined(__arm__) || defined(__aarch64__) || defined(__mips__)
 // Emulated TSC.
 // There is no instruction like RDTSCP in user mode on ARM. ARM's CP15 does
 //   not have a constant frequency like TSC on x86(_64), it may go faster
 //   or slower depending on CPU turbo or power saving mode. Furthermore,
 //   to read from CP15 on ARM a kernel modification or a driver is needed.
 //   We can not require this from users of compiler-rt.
 // So on ARM we use clock_gettime() which gives the result in nanoseconds.
 //   To get the measurements per second, we scale this by the number of

test/xray/TestCases/Linux/pic_test.cc

+// Test to check if we handle pic code properly.
+
+// RUN: %clangxx_xray -fxray-instrument -std=c++11 -fpic %s -o %t
+// RUN: XRAY_OPTIONS="verbosity=1 xray_logfile_base=pic-test-logging-" %run %t 2>&1 | FileCheck %s
+// After all that, clean up the output xray log.
+//
+// RUN: rm pic-test-logging-*
+
+#include <cstdio>
+
+[[clang::xray_always_instrument]]
+unsigned short foo (unsigned b);
+
+[[clang::xray_always_instrument]]
+unsigned short bar (unsigned short a)
+{
+  printf("bar() is always instrumented!\n");
+  return foo(a);
+}
+
+unsigned short foo (unsigned b)
+{
+  printf("foo() is always instrumented!\n");
+  return b + b + 5;
+}
+
+int main ()
+{
+  // CHECK: XRay: Log file in 'pic-test-logging-{{.*}}'
+  bar(10);
+  // CHECK: bar() is always instrumented!
+  // CHECK-NEXT: foo() is always instrumented!
+}