Implement fat runtime for hyperscan bzlmod build

[Copilot]

The current hyperscan overlay builds with -march=native, causing SIGILL crashes when binaries built on newer CPUs (AVX-512) run on older CPUs (AVX2). Implement fat runtime with multiple architecture variants and runtime dispatch.

Implementation

Architecture variants (5 total):

• core2 (-march=core2) - SSSE3 baseline
• corei7 (-march=corei7) - SSE4.2 + POPCNT
• avx2 (-march=core-avx2)
• avx512 (-march=skylake-avx512)
• avx512vbmi (-march=icelake-server)

Symbol renaming (rename_symbols.sh):

• Extracts .o files from each variant's archive
• Prefixes symbols with architecture (e.g., hs_scan → core2_hs_scan, avx2_hs_scan)
• Preserves allocation functions: hs_*_alloc, hs_*_free

Runtime dispatch (dispatcher.c):

• GNU ifunc resolvers select optimal implementation at load time
• CPUID-based feature detection (AVX-512 VBMI → AVX-512 → AVX2 → SSE4.2 → SSSE3)

Config updates:

• Added FAT_RUNTIME, BUILD_AVX512, BUILD_AVX512VBMI defines
• Added -Wno-unqualified-std-cast-call, -Wno-redundant-move, -fvisibility=hidden

Files

• fat_runtime.bzl - Macro for compiling and renaming each variant
• dispatcher.c - Upstream dispatcher (GNU ifunc resolvers)
• rename_symbols.sh - Symbol prefixing via objcopy
• BUILD.bazel - Replaced single runtime with 5 variants + dispatcher
• source.json - Updated overlay hashes

Result

Single binary runs on any x86-64 CPU (SSSE3+) with optimal SIMD dispatch. Matches upstream CMake FAT_RUNTIME=ON behavior.

Original prompt

Implement Fat Runtime for Hyperscan bzlmod Build

Problem

The current hyperscan bzlmod overlay in bazel-registry/modules/hyperscan/5.4.2.envoy/overlay/BUILD.bazel builds hyperscan without fat runtime support. This means:

1. The binary uses -march=native which only works on the machine it was compiled on
2. Running on older CPUs (e.g., a machine with only AVX2 when built on AVX-512) will cause SIGILL crashes
3. No runtime dispatch to optimal SIMD implementations based on CPU capabilities

The original envoy_cmake foreign_cc build used FAT_RUNTIME=on, BUILD_AVX512=on, BUILD_AVX512VBMI=on.

Solution

Implement fat runtime in the Bazel overlay, matching the upstream CMake behavior:

1. Build five architecture variants of the runtime library

Each with different -march flags:

• core2 (-march=core2) - SSSE3 baseline (oldest supported)
• corei7 (-march=corei7) - SSE4.2 + POPCNT
• avx2 (-march=core-avx2) - AVX2 (Haswell+)
• avx512 (-march=skylake-avx512) - AVX-512 (Skylake-X+)
• avx512vbmi (-march=icelake-server) - AVX-512 VBMI (Ice Lake+)

2. Symbol renaming

Use objcopy --redefine-syms to prefix each variant's symbols (e.g., hs_scan becomes core2_hs_scan, avx2_hs_scan, etc.). This prevents symbol conflicts when linking all variants together.

Symbols to keep unchanged (from upstream cmake/keep.syms.in):

• hs_misc_alloc, hs_misc_free
• hs_free_scratch
• hs_stream_alloc, hs_stream_free
• hs_scratch_alloc, hs_scratch_free
• hs_database_alloc, hs_database_free
• Symbols starting with _

3. Include dispatcher

Compile src/dispatcher.c which uses GNU ifunc attribute to resolve the correct implementation at load time based on CPUID checks.

4. Update config.h

Add the required defines:

#define FAT_RUNTIME
#define BUILD_AVX512
#define BUILD_AVX512VBMI

Additional Fixes

Also fix warning suppressions that were identified as missing:

1. Add -Wno-unqualified-std-cast-call - fixes warnings from ragel-generated Parser.cpp using move() instead of std::move()
2. Add -Wno-redundant-move - upstream CMake adds this for gcc 9+
3. Add -fvisibility=hidden - upstream CMake adds this for release builds

Reference Files

• Upstream CMakeLists.txt fat runtime section: https://github.com/intel/hyperscan/blob/6718839e6bde0cea8dbd40d0d7ae382bda88ec3b/CMakeLists.txt#L1212-L1275
• Upstream dispatcher.c: https://github.com/intel/hyperscan/blob/6718839e6bde0cea8dbd40d0d7ae382bda88ec3b/src/dispatcher.c
• Upstream build_wrapper.sh (symbol renaming): https://github.com/intel/hyperscan/blob/6718839e6bde0cea8dbd40d0d7ae382bda88ec3b/cmake/build_wrapper.sh
• Upstream keep.syms.in: https://github.com/intel/hyperscan/blob/6718839e6bde0cea8dbd40d0d7ae382bda88ec3b/cmake/keep.syms.in
• Current overlay to modify: https://github.com/envoyproxy/toolshed/blob/main/bazel-registry/modules/hyperscan/5.4.2.envoy/overlay/BUILD.bazel

Implementation Approach

1. Create a genrule for rename_symbols.sh script that handles symbol prefixing via objcopy
2. Create a macro _hs_exec_variant() that builds a cc_library with specific arch flags, then renames symbols
3. Use cc_import to bring renamed archives back into the dependency graph
4. Combine all variants with the dispatcher in hs_runtime
5. Update config.h genrule with fat runtime defines
6. Add missing warning suppression flags to copts

This pull request was created from Copilot chat.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[netlify]

✅ Deploy Preview for nifty-bassi-e26446 ready!

Name	Link
🔨 Latest commit	da99e5c
🔍 Latest deploy log	https://app.netlify.com/projects/nifty-bassi-e26446/deploys/697e48b9fb98ed000802eab2
😎 Deploy Preview	https://deploy-preview-3672--nifty-bassi-e26446.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.