LLVM Language Reference Manual¶
Abstract¶
This document is a reference manual for the LLVM assembly language. LLVM is a Static Single Assignment (SSA) based representation that provides type safety, low-level operations, flexibility, and the capability of representing ‘all’ high-level languages cleanly. It is the common code representation used throughout all phases of the LLVM compilation strategy.
Introduction¶
The LLVM code representation is designed to be used in three different forms: as an in-memory compiler IR, as an on-disk bitcode representation (suitable for fast loading by a Just-In-Time compiler), and as a human readable assembly language representation. This allows LLVM to provide a powerful intermediate representation for efficient compiler transformations and analysis, while providing a natural means to debug and visualize the transformations. The three different forms of LLVM are all equivalent. This document describes the human readable representation and notation.
The LLVM representation aims to be light-weight and low-level while being expressive, typed, and extensible at the same time. It aims to be a “universal IR” of sorts, by being at a low enough level that high-level ideas may be cleanly mapped to it (similar to how microprocessors are “universal IR’s”, allowing many source languages to be mapped to them). By providing type information, LLVM can be used as the target of optimizations: for example, through pointer analysis, it can be proven that a C automatic variable is never accessed outside of the current function, allowing it to be promoted to a simple SSA value instead of a memory location.
Well-Formedness¶
It is important to note that this document describes ‘well formed’ LLVM assembly language. There is a difference between what the parser accepts and what is considered ‘well formed’. For example, the following instruction is syntactically okay, but not well formed:
%x = add i32 1, %x
because the definition of %x
does not dominate all of its uses. The
LLVM infrastructure provides a verification pass that may be used to
verify that an LLVM module is well formed. This pass is automatically
run by the parser after parsing input assembly and by the optimizer
before it outputs bitcode. The violations pointed out by the verifier
pass indicate bugs in transformation passes or input to the parser.
Identifiers¶
LLVM identifiers come in two basic types: global and local. Global
identifiers (functions, global variables) begin with the '@'
character. Local identifiers (register names, types) begin with the
'%'
character. Additionally, there are three different formats for
identifiers, for different purposes:
Named values are represented as a string of characters with their prefix. For example,
%foo
,@DivisionByZero
,%a.really.long.identifier
. The actual regular expression used is ‘[%@][-a-zA-Z$._][-a-zA-Z$._0-9]*
’. Identifiers that require other characters in their names can be surrounded with quotes. Special characters may be escaped using"\xx"
wherexx
is the ASCII code for the character in hexadecimal. In this way, any character can be used in a name value, even quotes themselves. The"\01"
prefix can be used on global values to suppress mangling.Unnamed values are represented as an unsigned numeric value with their prefix. For example,
%12
,@2
,%44
.Constants, which are described in the section Constants below.
LLVM requires that values start with a prefix for two reasons: Compilers don’t need to worry about name clashes with reserved words, and the set of reserved words may be expanded in the future without penalty. Additionally, unnamed identifiers allow a compiler to quickly come up with a temporary variable without having to avoid symbol table conflicts.
Reserved words in LLVM are very similar to reserved words in other
languages. There are keywords for different opcodes (’add
’,
‘bitcast
’, ‘ret
’, etc…), for primitive type names (’void
’,
‘i32
’, etc…), and others. These reserved words cannot conflict
with variable names, because none of them start with a prefix character
('%'
or '@'
).
Here is an example of LLVM code to multiply the integer variable
‘%X
’ by 8:
The easy way:
%result = mul i32 %X, 8
After strength reduction:
%result = shl i32 %X, 3
And the hard way:
%0 = add i32 %X, %X ; yields i32:%0
%1 = add i32 %0, %0 ; yields i32:%1
%result = add i32 %1, %1
This last way of multiplying %X
by 8 illustrates several important
lexical features of LLVM:
Comments are delimited with a ‘
;
’ and go until the end of line.Unnamed temporaries are created when the result of a computation is not assigned to a named value.
Unnamed temporaries are numbered sequentially (using a per-function incrementing counter, starting with 0). Note that basic blocks and unnamed function parameters are included in this numbering. For example, if the entry basic block is not given a label name and all function parameters are named, then it will get number 0.
It also shows a convention that we follow in this document. When demonstrating instructions, we will follow an instruction with a comment that defines the type and name of value produced.
High Level Structure¶
Module Structure¶
LLVM programs are composed of Module
’s, each of which is a
translation unit of the input programs. Each module consists of
functions, global variables, and symbol table entries. Modules may be
combined together with the LLVM linker, which merges function (and
global variable) definitions, resolves forward declarations, and merges
symbol table entries. Here is an example of the “hello world” module:
; Declare the string constant as a global constant.
@.str = private unnamed_addr constant [13 x i8] c"hello world\0A\00"
; External declaration of the puts function
declare i32 @puts(ptr nocapture) nounwind
; Definition of main function
define i32 @main() {
; Call puts function to write out the string to stdout.
call i32 @puts(ptr @.str)
ret i32 0
}
; Named metadata
!0 = !{i32 42, null, !"string"}
!foo = !{!0}
This example is made up of a global variable named
“.str
”, an external declaration of the “puts
” function, a
function definition for “main
” and
named metadata “foo
”.
In general, a module is made up of a list of global values (where both functions and global variables are global values). Global values are represented by a pointer to a memory location (in this case, a pointer to an array of char, and a pointer to a function), and have one of the following linkage types.
Linkage Types¶
All Global Variables and Functions have one of the following types of linkage:
private
Global values with “
private
” linkage are only directly accessible by objects in the current module. In particular, linking code into a module with a private global value may cause the private to be renamed as necessary to avoid collisions. Because the symbol is private to the module, all references can be updated. This doesn’t show up in any symbol table in the object file.internal
Similar to private, but the value shows as a local symbol (
STB_LOCAL
in the case of ELF) in the object file. This corresponds to the notion of the ‘static
’ keyword in C.available_externally
Globals with “
available_externally
” linkage are never emitted into the object file corresponding to the LLVM module. From the linker’s perspective, anavailable_externally
global is equivalent to an external declaration. They exist to allow inlining and other optimizations to take place given knowledge of the definition of the global, which is known to be somewhere outside the module. Globals withavailable_externally
linkage are allowed to be discarded at will, and allow inlining and other optimizations. This linkage type is only allowed on definitions, not declarations.linkonce
Globals with “
linkonce
” linkage are merged with other globals of the same name when linkage occurs. This can be used to implement some forms of inline functions, templates, or other code which must be generated in each translation unit that uses it, but where the body may be overridden with a more definitive definition later. Unreferencedlinkonce
globals are allowed to be discarded. Note thatlinkonce
linkage does not actually allow the optimizer to inline the body of this function into callers because it doesn’t know if this definition of the function is the definitive definition within the program or whether it will be overridden by a stronger definition. To enable inlining and other optimizations, use “linkonce_odr
” linkage.weak
“
weak
” linkage has the same merging semantics aslinkonce
linkage, except that unreferenced globals withweak
linkage may not be discarded. This is used for globals that are declared “weak” in C source code.common
“
common
” linkage is most similar to “weak
” linkage, but they are used for tentative definitions in C, such as “int X;
” at global scope. Symbols with “common
” linkage are merged in the same way asweak symbols
, and they may not be deleted if unreferenced.common
symbols may not have an explicit section, must have a zero initializer, and may not be marked ‘constant’. Functions and aliases may not have common linkage.
appending
“
appending
” linkage may only be applied to global variables of pointer to array type. When two global variables with appending linkage are linked together, the two global arrays are appended together. This is the LLVM, typesafe, equivalent of having the system linker append together “sections” with identical names when .o files are linked.Unfortunately this doesn’t correspond to any feature in .o files, so it can only be used for variables like
llvm.global_ctors
which llvm interprets specially.extern_weak
The semantics of this linkage follow the ELF object file model: the symbol is weak until linked, if not linked, the symbol becomes null instead of being an undefined reference.
linkonce_odr
,weak_odr
Some languages allow differing globals to be merged, such as two functions with different semantics. Other languages, such as
C++
, ensure that only equivalent globals are ever merged (the “one definition rule” — “ODR”). Such languages can use thelinkonce_odr
andweak_odr
linkage types to indicate that the global will only be merged with equivalent globals. These linkage types are otherwise the same as their non-odr
versions.external
If none of the above identifiers are used, the global is externally visible, meaning that it participates in linkage and can be used to resolve external symbol references.
It is illegal for a global variable or function declaration to have any
linkage type other than external
or extern_weak
.
Calling Conventions¶
LLVM functions, calls and invokes can all have an optional calling convention specified for the call. The calling convention of any pair of dynamic caller/callee must match, or the behavior of the program is undefined. The following calling conventions are supported by LLVM, and more may be added in the future:
- “
ccc
” - The C calling convention This calling convention (the default if no other calling convention is specified) matches the target C calling conventions. This calling convention supports varargs function calls and tolerates some mismatch in the declared prototype and implemented declaration of the function (as does normal C).
- “
fastcc
” - The fast calling convention This calling convention attempts to make calls as fast as possible (e.g. by passing things in registers). This calling convention allows the target to use whatever tricks it wants to produce fast code for the target, without having to conform to an externally specified ABI (Application Binary Interface). Tail calls can only be optimized when this, the tailcc, the GHC or the HiPE convention is used. This calling convention does not support varargs and requires the prototype of all callees to exactly match the prototype of the function definition.
- “
coldcc
” - The cold calling convention This calling convention attempts to make code in the caller as efficient as possible under the assumption that the call is not commonly executed. As such, these calls often preserve all registers so that the call does not break any live ranges in the caller side. This calling convention does not support varargs and requires the prototype of all callees to exactly match the prototype of the function definition. Furthermore the inliner doesn’t consider such function calls for inlining.
- “
ghccc
” - GHC convention This calling convention has been implemented specifically for use by the Glasgow Haskell Compiler (GHC). It passes everything in registers, going to extremes to achieve this by disabling callee save registers. This calling convention should not be used lightly but only for specific situations such as an alternative to the register pinning performance technique often used when implementing functional programming languages. At the moment only X86, AArch64, and RISCV support this convention. The following limitations exist:
On X86-32 only up to 4 bit type parameters are supported. No floating-point types are supported.
On X86-64 only up to 10 bit type parameters and 6 floating-point parameters are supported.
On AArch64 only up to 4 32-bit floating-point parameters, 4 64-bit floating-point parameters, and 10 bit type parameters are supported.
RISCV64 only supports up to 11 bit type parameters, 4 32-bit floating-point parameters, and 4 64-bit floating-point parameters.
This calling convention supports tail call optimization but requires both the caller and callee are using it.
- “
cc 11
” - The HiPE calling convention This calling convention has been implemented specifically for use by the High-Performance Erlang (HiPE) compiler, the native code compiler of the Ericsson’s Open Source Erlang/OTP system. It uses more registers for argument passing than the ordinary C calling convention and defines no callee-saved registers. The calling convention properly supports tail call optimization but requires that both the caller and the callee use it. It uses a register pinning mechanism, similar to GHC’s convention, for keeping frequently accessed runtime components pinned to specific hardware registers. At the moment only X86 supports this convention (both 32 and 64 bit).
- “
anyregcc
” - Dynamic calling convention for code patching This is a special convention that supports patching an arbitrary code sequence in place of a call site. This convention forces the call arguments into registers but allows them to be dynamically allocated. This can currently only be used with calls to llvm.experimental.patchpoint because only this intrinsic records the location of its arguments in a side table. See Stack maps and patch points in LLVM.
- “
preserve_mostcc
” - The PreserveMost calling convention This calling convention attempts to make the code in the caller as unintrusive as possible. This convention behaves identically to the C calling convention on how arguments and return values are passed, but it uses a different set of caller/callee-saved registers. This alleviates the burden of saving and recovering a large register set before and after the call in the caller. If the arguments are passed in callee-saved registers, then they will be preserved by the callee across the call. This doesn’t apply for values returned in callee-saved registers.
On X86-64 the callee preserves all general purpose registers, except for R11 and return registers, if any. R11 can be used as a scratch register. The treatment of floating-point registers (XMMs/YMMs) matches the OS’s C calling convention: on most platforms, they are not preserved and need to be saved by the caller, but on Windows, xmm6-xmm15 are preserved.
On AArch64 the callee preserve all general purpose registers, except X0-X8 and X16-X18.
The idea behind this convention is to support calls to runtime functions that have a hot path and a cold path. The hot path is usually a small piece of code that doesn’t use many registers. The cold path might need to call out to another function and therefore only needs to preserve the caller-saved registers, which haven’t already been saved by the caller. The PreserveMost calling convention is very similar to the cold calling convention in terms of caller/callee-saved registers, but they are used for different types of function calls. coldcc is for function calls that are rarely executed, whereas preserve_mostcc function calls are intended to be on the hot path and definitely executed a lot. Furthermore preserve_mostcc doesn’t prevent the inliner from inlining the function call.
This calling convention will be used by a future version of the ObjectiveC runtime and should therefore still be considered experimental at this time. Although this convention was created to optimize certain runtime calls to the ObjectiveC runtime, it is not limited to this runtime and might be used by other runtimes in the future too. The current implementation only supports X86-64, but the intention is to support more architectures in the future.
- “
preserve_allcc
” - The PreserveAll calling convention This calling convention attempts to make the code in the caller even less intrusive than the PreserveMost calling convention. This calling convention also behaves identical to the C calling convention on how arguments and return values are passed, but it uses a different set of caller/callee-saved registers. This removes the burden of saving and recovering a large register set before and after the call in the caller. If the arguments are passed in callee-saved registers, then they will be preserved by the callee across the call. This doesn’t apply for values returned in callee-saved registers.
On X86-64 the callee preserves all general purpose registers, except for R11. R11 can be used as a scratch register. Furthermore it also preserves all floating-point registers (XMMs/YMMs).
On AArch64 the callee preserve all general purpose registers, except X0-X8 and X16-X18. Furthermore it also preserves lower 128 bits of V8-V31 SIMD - floating point registers.
The idea behind this convention is to support calls to runtime functions that don’t need to call out to any other functions.
This calling convention, like the PreserveMost calling convention, will be used by a future version of the ObjectiveC runtime and should be considered experimental at this time.
- “
cxx_fast_tlscc
” - The CXX_FAST_TLS calling convention for access functions Clang generates an access function to access C++-style TLS. The access function generally has an entry block, an exit block and an initialization block that is run at the first time. The entry and exit blocks can access a few TLS IR variables, each access will be lowered to a platform-specific sequence.
This calling convention aims to minimize overhead in the caller by preserving as many registers as possible (all the registers that are preserved on the fast path, composed of the entry and exit blocks).
This calling convention behaves identical to the C calling convention on how arguments and return values are passed, but it uses a different set of caller/callee-saved registers.
Given that each platform has its own lowering sequence, hence its own set of preserved registers, we can’t use the existing PreserveMost.
On X86-64 the callee preserves all general purpose registers, except for RDI and RAX.
- “
tailcc
” - Tail callable calling convention This calling convention ensures that calls in tail position will always be tail call optimized. This calling convention is equivalent to fastcc, except for an additional guarantee that tail calls will be produced whenever possible. Tail calls can only be optimized when this, the fastcc, the GHC or the HiPE convention is used. This calling convention does not support varargs and requires the prototype of all callees to exactly match the prototype of the function definition.
- “
swiftcc
” - This calling convention is used for Swift language. On X86-64 RCX and R8 are available for additional integer returns, and XMM2 and XMM3 are available for additional FP/vector returns.
On iOS platforms, we use AAPCS-VFP calling convention.
- “
swifttailcc
” This calling convention is like
swiftcc
in most respects, but also the callee pops the argument area of the stack so that mandatory tail calls are possible as intailcc
.- “
cfguard_checkcc
” - Windows Control Flow Guard (Check mechanism) This calling convention is used for the Control Flow Guard check function, calls to which can be inserted before indirect calls to check that the call target is a valid function address. The check function has no return value, but it will trigger an OS-level error if the address is not a valid target. The set of registers preserved by the check function, and the register containing the target address are architecture-specific.
On X86 the target address is passed in ECX.
On ARM the target address is passed in R0.
On AArch64 the target address is passed in X15.
- “
cc <n>
” - Numbered convention Any calling convention may be specified by number, allowing target-specific calling conventions to be used. Target specific calling conventions start at 64.
More calling conventions can be added/defined on an as-needed basis, to support Pascal conventions or any other well-known target-independent convention.
Visibility Styles¶
All Global Variables and Functions have one of the following visibility styles:
- “
default
” - Default style On targets that use the ELF object file format, default visibility means that the declaration is visible to other modules and, in shared libraries, means that the declared entity may be overridden. On Darwin, default visibility means that the declaration is visible to other modules. On XCOFF, default visibility means no explicit visibility bit will be set and whether the symbol is visible (i.e “exported”) to other modules depends primarily on export lists provided to the linker. Default visibility corresponds to “external linkage” in the language.
- “
hidden
” - Hidden style Two declarations of an object with hidden visibility refer to the same object if they are in the same shared object. Usually, hidden visibility indicates that the symbol will not be placed into the dynamic symbol table, so no other module (executable or shared library) can reference it directly.
- “
protected
” - Protected style On ELF, protected visibility indicates that the symbol will be placed in the dynamic symbol table, but that references within the defining module will bind to the local symbol. That is, the symbol cannot be overridden by another module.
A symbol with internal
or private
linkage must have default
visibility.
DLL Storage Classes¶
All Global Variables, Functions and Aliases can have one of the following DLL storage class:
dllimport
“
dllimport
” causes the compiler to reference a function or variable via a global pointer to a pointer that is set up by the DLL exporting the symbol. On Microsoft Windows targets, the pointer name is formed by combining__imp_
and the function or variable name.dllexport
On Microsoft Windows targets, “
dllexport
” causes the compiler to provide a global pointer to a pointer in a DLL, so that it can be referenced with thedllimport
attribute. the pointer name is formed by combining__imp_
and the function or variable name. On XCOFF targets,dllexport
indicates that the symbol will be made visible to other modules using “exported” visibility and thus placed by the linker in the loader section symbol table. Since this storage class exists for defining a dll interface, the compiler, assembler and linker know it is externally referenced and must refrain from deleting the symbol.
A symbol with internal
or private
linkage cannot have a DLL storage
class.
Thread Local Storage Models¶
A variable may be defined as thread_local
, which means that it will
not be shared by threads (each thread will have a separated copy of the
variable). Not all targets support thread-local variables. Optionally, a
TLS model may be specified:
localdynamic
For variables that are only used within the current shared library.
initialexec
For variables in modules that will not be loaded dynamically.
localexec
For variables defined in the executable and only used within it.
If no explicit model is given, the “general dynamic” model is used.
The models correspond to the ELF TLS models; see ELF Handling For Thread-Local Storage for more information on under which circumstances the different models may be used. The target may choose a different TLS model if the specified model is not supported, or if a better choice of model can be made.
A model can also be specified in an alias, but then it only governs how the alias is accessed. It will not have any effect in the aliasee.
For platforms without linker support of ELF TLS model, the -femulated-tls flag can be used to generate GCC compatible emulated TLS code.
Runtime Preemption Specifiers¶
Global variables, functions and aliases may have an optional runtime preemption
specifier. If a preemption specifier isn’t given explicitly, then a
symbol is assumed to be dso_preemptable
.
dso_preemptable
Indicates that the function or variable may be replaced by a symbol from outside the linkage unit at runtime.
dso_local
The compiler may assume that a function or variable marked as
dso_local
will resolve to a symbol within the same linkage unit. Direct access will be generated even if the definition is not within this compilation unit.
Structure Types¶
LLVM IR allows you to specify both “identified” and “literal” structure types. Literal types are uniqued structurally, but identified types are never uniqued. An opaque structural type can also be used to forward declare a type that is not yet available.
An example of an identified structure specification is:
%mytype = type { %mytype*, i32 }
Prior to the LLVM 3.0 release, identified types were structurally uniqued. Only literal types are uniqued in recent versions of LLVM.
Non-Integral Pointer Type¶
Note: non-integral pointer types are a work in progress, and they should be considered experimental at this time.
LLVM IR optionally allows the frontend to denote pointers in certain address spaces as “non-integral” via the datalayout string. Non-integral pointer types represent pointers that have an unspecified bitwise representation; that is, the integral representation may be target dependent or unstable (not backed by a fixed integer).
inttoptr
and ptrtoint
instructions have the same semantics as for
integral (i.e. normal) pointers in that they convert integers to and from
corresponding pointer types, but there are additional implications to be
aware of. Because the bit-representation of a non-integral pointer may
not be stable, two identical casts of the same operand may or may not
return the same value. Said differently, the conversion to or from the
non-integral type depends on environmental state in an implementation
defined manner.
If the frontend wishes to observe a particular value following a cast, the
generated IR must fence with the underlying environment in an implementation
defined manner. (In practice, this tends to require noinline
routines for
such operations.)
From the perspective of the optimizer, inttoptr
and ptrtoint
for
non-integral types are analogous to ones on integral types with one
key exception: the optimizer may not, in general, insert new dynamic
occurrences of such casts. If a new cast is inserted, the optimizer would
need to either ensure that a) all possible values are valid, or b)
appropriate fencing is inserted. Since the appropriate fencing is
implementation defined, the optimizer can’t do the latter. The former is
challenging as many commonly expected properties, such as
ptrtoint(v)-ptrtoint(v) == 0
, don’t hold for non-integral types.
Similar restrictions apply to intrinsics that might examine the pointer bits,
such as llvm.ptrmask.
The alignment information provided by the frontend for a non-integral pointer (typically using attributes or metadata) must be valid for every possible representation of the pointer.
Global Variables¶
Global variables define regions of memory allocated at compilation time instead of run-time.
Global variable definitions must be initialized.
Global variables in other translation units can also be declared, in which case they don’t have an initializer.
Global variables can optionally specify a linkage type.
Either global variable definitions or declarations may have an explicit section to be placed in and may have an optional explicit alignment specified. If there is a mismatch between the explicit or inferred section information for the variable declaration and its definition the resulting behavior is undefined.
A variable may be defined as a global constant
, which indicates that
the contents of the variable will never be modified (enabling better
optimization, allowing the global data to be placed in the read-only
section of an executable, etc). Note that variables that need runtime
initialization cannot be marked constant
as there is a store to the
variable.
LLVM explicitly allows declarations of global variables to be marked constant, even if the final definition of the global is not. This capability can be used to enable slightly better optimization of the program, but requires the language definition to guarantee that optimizations based on the ‘constantness’ are valid for the translation units that do not include the definition.
As SSA values, global variables define pointer values that are in scope (i.e. they dominate) all basic blocks in the program. Global variables always define a pointer to their “content” type because they describe a region of memory, and all memory objects in LLVM are accessed through pointers.
Global variables can be marked with unnamed_addr
which indicates
that the address is not significant, only the content. Constants marked
like this can be merged with other constants if they have the same
initializer. Note that a constant with significant address can be
merged with a unnamed_addr
constant, the result being a constant
whose address is significant.
If the local_unnamed_addr
attribute is given, the address is known to
not be significant within the module.
A global variable may be declared to reside in a target-specific numbered address space. For targets that support them, address spaces may affect how optimizations are performed and/or what target instructions are used to access the variable. The default address space is zero. The address space qualifier must precede any other attributes.
LLVM allows an explicit section to be specified for globals. If the target supports it, it will emit globals to the section specified. Additionally, the global can placed in a comdat if the target has the necessary support.
External declarations may have an explicit section specified. Section information is retained in LLVM IR for targets that make use of this information. Attaching section information to an external declaration is an assertion that its definition is located in the specified section. If the definition is located in a different section, the behavior is undefined.
LLVM allows an explicit code model to be specified for globals. If the target supports it, it will emit globals in the code model specified, overriding the code model used to compile the translation unit. The allowed values are “tiny”, “small”, “kernel”, “medium”, “large”. This may be extended in the future to specify global data layout that doesn’t cleanly fit into a specific code model.
By default, global initializers are optimized by assuming that global
variables defined within the module are not modified from their
initial values before the start of the global initializer. This is
true even for variables potentially accessible from outside the
module, including those with external linkage or appearing in
@llvm.used
or dllexported variables. This assumption may be suppressed
by marking the variable with externally_initialized
.
An explicit alignment may be specified for a global, which must be a
power of 2. If not present, or if the alignment is set to zero, the
alignment of the global is set by the target to whatever it feels
convenient. If an explicit alignment is specified, the global is forced
to have exactly that alignment. Targets and optimizers are not allowed
to over-align the global if the global has an assigned section. In this
case, the extra alignment could be observable: for example, code could
assume that the globals are densely packed in their section and try to
iterate over them as an array, alignment padding would break this
iteration. For TLS variables, the module flag MaxTLSAlign
, if present,
limits the alignment to the given value. Optimizers are not allowed to
impose a stronger alignment on these variables. The maximum alignment
is 1 << 32
.
For global variable declarations, as well as definitions that may be
replaced at link time (linkonce
, weak
, extern_weak
and common
linkage types), the allocation size and alignment of the definition it resolves
to must be greater than or equal to that of the declaration or replaceable
definition, otherwise the behavior is undefined.
Globals can also have a DLL storage class, an optional runtime preemption specifier, an optional global attributes and an optional list of attached metadata.
Variables and aliases can have a Thread Local Storage Model.
Globals cannot be or contain Scalable vectors because their
size is unknown at compile time. They are allowed in structs to facilitate
intrinsics returning multiple values. Generally, structs containing scalable
vectors are not considered “sized” and cannot be used in loads, stores, allocas,
or GEPs. The only exception to this rule is for structs that contain scalable
vectors of the same type (e.g. {<vscale x 2 x i32>, <vscale x 2 x i32>}
contains the same type while {<vscale x 2 x i32>, <vscale x 2 x i64>}
doesn’t). These kinds of structs (we may call them homogeneous scalable vector
structs) are considered sized and can be used in loads, stores, allocas, but
not GEPs.
Syntax:
@<GlobalVarName> = [Linkage] [PreemptionSpecifier] [Visibility]
[DLLStorageClass] [ThreadLocal]
[(unnamed_addr|local_unnamed_addr)] [AddrSpace]
[ExternallyInitialized]
<global | constant> <Type> [<InitializerConstant>]
[, section "name"] [, partition "name"]
[, comdat [($name)]] [, align <Alignment>]
[, code_model "model"]
[, no_sanitize_address] [, no_sanitize_hwaddress]
[, sanitize_address_dyninit] [, sanitize_memtag]
(, !name !N)*
For example, the following defines a global in a numbered address space with an initializer, section, and alignment:
@G = addrspace(5) constant float 1.0, section "foo", align 4
The following example just declares a global variable
@G = external global i32
The following example defines a global variable with the
large
code model:
@G = internal global i32 0, code_model "large"
The following example defines a thread-local global with the
initialexec
TLS model:
@G = thread_local(initialexec) global i32 0, align 4
Functions¶
LLVM function definitions consist of the “define
” keyword, an
optional linkage type, an optional runtime preemption
specifier, an optional visibility
style, an optional DLL storage class,
an optional calling convention,
an optional unnamed_addr
attribute, a return type, an optional
parameter attribute for the return type, a function
name, a (possibly empty) argument list (each with optional parameter
attributes), optional function attributes,
an optional address space, an optional section, an optional partition,
an optional alignment, an optional comdat,
an optional garbage collector name, an optional prefix,
an optional prologue,
an optional personality,
an optional list of attached metadata,
an opening curly brace, a list of basic blocks, and a closing curly brace.
Syntax:
define [linkage] [PreemptionSpecifier] [visibility] [DLLStorageClass]
[cconv] [ret attrs]
<ResultType> @<FunctionName> ([argument list])
[(unnamed_addr|local_unnamed_addr)] [AddrSpace] [fn Attrs]
[section "name"] [partition "name"] [comdat [($name)]] [align N]
[gc] [prefix Constant] [prologue Constant] [personality Constant]
(!name !N)* { ... }
The argument list is a comma separated sequence of arguments where each argument is of the following form:
Syntax:
<type> [parameter Attrs] [name]
LLVM function declarations consist of the “declare
” keyword, an
optional linkage type, an optional visibility style, an optional DLL storage class, an
optional calling convention, an optional unnamed_addr
or local_unnamed_addr
attribute, an optional address space, a return type,
an optional parameter attribute for the return type, a function name, a possibly
empty list of arguments, an optional alignment, an optional garbage
collector name, an optional prefix, and an optional
prologue.
Syntax:
declare [linkage] [visibility] [DLLStorageClass]
[cconv] [ret attrs]
<ResultType> @<FunctionName> ([argument list])
[(unnamed_addr|local_unnamed_addr)] [align N] [gc]
[prefix Constant] [prologue Constant]
A function definition contains a list of basic blocks, forming the CFG (Control Flow Graph) for the function. Each basic block may optionally start with a label (giving the basic block a symbol table entry), contains a list of instructions, and ends with a terminator instruction (such as a branch or function return). If an explicit label name is not provided, a block is assigned an implicit numbered label, using the next value from the same counter as used for unnamed temporaries (see above). For example, if a function entry block does not have an explicit label, it will be assigned label “%0”, then the first unnamed temporary in that block will be “%1”, etc. If a numeric label is explicitly specified, it must match the numeric label that would be used implicitly.
The first basic block in a function is special in two ways: it is immediately executed on entrance to the function, and it is not allowed to have predecessor basic blocks (i.e. there can not be any branches to the entry block of a function). Because the block can have no predecessors, it also cannot have any PHI nodes.
LLVM allows an explicit section to be specified for functions. If the target supports it, it will emit functions to the section specified. Additionally, the function can be placed in a COMDAT.
An explicit alignment may be specified for a function. If not present, or if the alignment is set to zero, the alignment of the function is set by the target to whatever it feels convenient. If an explicit alignment is specified, the function is forced to have at least that much alignment. All alignments must be a power of 2.
If the unnamed_addr
attribute is given, the address is known to not
be significant and two identical functions can be merged.
If the local_unnamed_addr
attribute is given, the address is known to
not be significant within the module.
If an explicit address space is not given, it will default to the program address space from the datalayout string.
Aliases¶
Aliases, unlike function or variables, don’t create any new data. They are just a new symbol and metadata for an existing position.
Aliases have a name and an aliasee that is either a global value or a constant expression.
Aliases may have an optional linkage type, an optional runtime preemption specifier, an optional visibility style, an optional DLL storage class and an optional tls model.
Syntax:
@<Name> = [Linkage] [PreemptionSpecifier] [Visibility] [DLLStorageClass] [ThreadLocal] [(unnamed_addr|local_unnamed_addr)] alias <AliaseeTy>, <AliaseeTy>* @<Aliasee>
[, partition "name"]
The linkage must be one of private
, internal
, linkonce
, weak
,
linkonce_odr
, weak_odr
, external
, available_externally
. Note
that some system linkers might not correctly handle dropping a weak symbol that
is aliased.
Aliases that are not unnamed_addr
are guaranteed to have the same address as
the aliasee expression. unnamed_addr
ones are only guaranteed to point
to the same content.
If the local_unnamed_addr
attribute is given, the address is known to
not be significant within the module.
Since aliases are only a second name, some restrictions apply, of which some can only be checked when producing an object file:
The expression defining the aliasee must be computable at assembly time. Since it is just a name, no relocations can be used.
No alias in the expression can be weak as the possibility of the intermediate alias being overridden cannot be represented in an object file.
If the alias has the
available_externally
linkage, the aliasee must be anavailable_externally
global value; otherwise the aliasee can be an expression but no global value in the expression can be a declaration, since that would require a relocation, which is not possible.If either the alias or the aliasee may be replaced by a symbol outside the module at link time or runtime, any optimization cannot replace the alias with the aliasee, since the behavior may be different. The alias may be used as a name guaranteed to point to the content in the current module.
IFuncs¶
IFuncs, like as aliases, don’t create any new data or func. They are just a new symbol that is resolved at runtime by calling a resolver function.
On ELF platforms, IFuncs are resolved by the dynamic linker at load time. On
Mach-O platforms, they are lowered in terms of .symbol_resolver
functions,
which lazily resolve the callee the first time they are called.
IFunc may have an optional linkage type and an optional visibility style.
Syntax:
@<Name> = [Linkage] [PreemptionSpecifier] [Visibility] ifunc <IFuncTy>, <ResolverTy>* @<Resolver>
[, partition "name"]
Comdats¶
Comdat IR provides access to object file COMDAT/section group functionality which represents interrelated sections.
Comdats have a name which represents the COMDAT key and a selection kind to provide input on how the linker deduplicates comdats with the same key in two different object files. A comdat must be included or omitted as a unit. Discarding the whole comdat is allowed but discarding a subset is not.
A global object may be a member of at most one comdat. Aliases are placed in the same COMDAT that their aliasee computes to, if any.
Syntax:
$<Name> = comdat SelectionKind
For selection kinds other than nodeduplicate
, only one of the duplicate
comdats may be retained by the linker and the members of the remaining comdats
must be discarded. The following selection kinds are supported:
any
The linker may choose any COMDAT key, the choice is arbitrary.
exactmatch
The linker may choose any COMDAT key but the sections must contain the same data.
largest
The linker will choose the section containing the largest COMDAT key.
nodeduplicate
No deduplication is performed.
samesize
The linker may choose any COMDAT key but the sections must contain the same amount of data.
XCOFF and Mach-O don’t support COMDATs.
COFF supports all selection kinds. Non-
nodeduplicate
selection kinds need a non-local linkage COMDAT symbol.ELF supports
any
andnodeduplicate
.WebAssembly only supports
any
.
Here is an example of a COFF COMDAT where a function will only be selected if the COMDAT key’s section is the largest:
$foo = comdat largest
@foo = global i32 2, comdat($foo)
define void @bar() comdat($foo) {
ret void
}
In a COFF object file, this will create a COMDAT section with selection kind
IMAGE_COMDAT_SELECT_LARGEST
containing the contents of the @foo
symbol
and another COMDAT section with selection kind
IMAGE_COMDAT_SELECT_ASSOCIATIVE
which is associated with the first COMDAT
section and contains the contents of the @bar
symbol.
As a syntactic sugar the $name
can be omitted if the name is the same as
the global name:
$foo = comdat any
@foo = global i32 2, comdat
@bar = global i32 3, comdat($foo)
There are some restrictions on the properties of the global object. It, or an alias to it, must have the same name as the COMDAT group when targeting COFF. The contents and size of this object may be used during link-time to determine which COMDAT groups get selected depending on the selection kind. Because the name of the object must match the name of the COMDAT group, the linkage of the global object must not be local; local symbols can get renamed if a collision occurs in the symbol table.
The combined use of COMDATS and section attributes may yield surprising results. For example:
$foo = comdat any
$bar = comdat any
@g1 = global i32 42, section "sec", comdat($foo)
@g2 = global i32 42, section "sec", comdat($bar)
From the object file perspective, this requires the creation of two sections with the same name. This is necessary because both globals belong to different COMDAT groups and COMDATs, at the object file level, are represented by sections.
Note that certain IR constructs like global variables and functions may create COMDATs in the object file in addition to any which are specified using COMDAT IR. This arises when the code generator is configured to emit globals in individual sections (e.g. when -data-sections or -function-sections is supplied to llc).
Named Metadata¶
Named metadata is a collection of metadata. Metadata nodes (but not metadata strings) are the only valid operands for a named metadata.
Named metadata are represented as a string of characters with the metadata prefix. The rules for metadata names are the same as for identifiers, but quoted names are not allowed.
"\xx"
type escapes are still valid, which allows any character to be part of a name.
Syntax:
; Some unnamed metadata nodes, which are referenced by the named metadata.
!0 = !{!"zero"}
!1 = !{!"one"}
!2 = !{!"two"}
; A named metadata.
!name = !{!0, !1, !2}
Parameter Attributes¶
The return type and each parameter of a function type may have a set of parameter attributes associated with them. Parameter attributes are used to communicate additional information about the result or parameters of a function. Parameter attributes are considered to be part of the function, not of the function type, so functions with different parameter attributes can have the same function type.
Parameter attributes are simple keywords that follow the type specified. If multiple parameter attributes are needed, they are space separated. For example:
declare i32 @printf(ptr noalias nocapture, ...)
declare i32 @atoi(i8 zeroext)
declare signext i8 @returns_signed_char()
Note that any attributes for the function result (nonnull
,
signext
) come before the result type.
Currently, only the following parameter attributes are defined:
zeroext
This indicates to the code generator that the parameter or return value should be zero-extended to the extent required by the target’s ABI by the caller (for a parameter) or the callee (for a return value).
signext
This indicates to the code generator that the parameter or return value should be sign-extended to the extent required by the target’s ABI (which is usually 32-bits) by the caller (for a parameter) or the callee (for a return value).
inreg
This indicates that this parameter or return value should be treated in a special target-dependent fashion while emitting code for a function call or return (usually, by putting it in a register as opposed to memory, though some targets use it to distinguish between two different kinds of registers). Use of this attribute is target-specific.
byval(<ty>)
This indicates that the pointer parameter should really be passed by value to the function. The attribute implies that a hidden copy of the pointee is made between the caller and the callee, so the callee is unable to modify the value in the caller. This attribute is only valid on LLVM pointer arguments. It is generally used to pass structs and arrays by value, but is also valid on pointers to scalars. The copy is considered to belong to the caller not the callee (for example,
readonly
functions should not write tobyval
parameters). This is not a valid attribute for return values.The byval type argument indicates the in-memory value type, and must be the same as the pointee type of the argument.
The byval attribute also supports specifying an alignment with the align attribute. It indicates the alignment of the stack slot to form and the known alignment of the pointer specified to the call site. If the alignment is not specified, then the code generator makes a target-specific assumption.
byref(<ty>)
The
byref
argument attribute allows specifying the pointee memory type of an argument. This is similar tobyval
, but does not imply a copy is made anywhere, or that the argument is passed on the stack. This implies the pointer is dereferenceable up to the storage size of the type.It is not generally permissible to introduce a write to an
byref
pointer. The pointer may have any address space and may be read only.This is not a valid attribute for return values.
The alignment for an
byref
parameter can be explicitly specified by combining it with thealign
attribute, similar tobyval
. If the alignment is not specified, then the code generator makes a target-specific assumption.This is intended for representing ABI constraints, and is not intended to be inferred for optimization use.
preallocated(<ty>)
This indicates that the pointer parameter should really be passed by value to the function, and that the pointer parameter’s pointee has already been initialized before the call instruction. This attribute is only valid on LLVM pointer arguments. The argument must be the value returned by the appropriate llvm.call.preallocated.arg on non
musttail
calls, or the corresponding caller parameter inmusttail
calls, although it is ignored during codegen.A non
musttail
function call with apreallocated
attribute in any parameter must have a"preallocated"
operand bundle. Amusttail
function call cannot have a"preallocated"
operand bundle.The preallocated attribute requires a type argument, which must be the same as the pointee type of the argument.
The preallocated attribute also supports specifying an alignment with the align attribute. It indicates the alignment of the stack slot to form and the known alignment of the pointer specified to the call site. If the alignment is not specified, then the code generator makes a target-specific assumption.
inalloca(<ty>)
The
inalloca
argument attribute allows the caller to take the address of outgoing stack arguments. Aninalloca
argument must be a pointer to stack memory produced by analloca
instruction. The alloca, or argument allocation, must also be tagged with the inalloca keyword. Only the last argument may have theinalloca
attribute, and that argument is guaranteed to be passed in memory.An argument allocation may be used by a call at most once because the call may deallocate it. The
inalloca
attribute cannot be used in conjunction with other attributes that affect argument storage, likeinreg
,nest
,sret
, orbyval
. Theinalloca
attribute also disables LLVM’s implicit lowering of large aggregate return values, which means that frontend authors must lower them withsret
pointers.When the call site is reached, the argument allocation must have been the most recent stack allocation that is still live, or the behavior is undefined. It is possible to allocate additional stack space after an argument allocation and before its call site, but it must be cleared off with llvm.stackrestore.
The inalloca attribute requires a type argument, which must be the same as the pointee type of the argument.
See Design and Usage of the InAlloca Attribute for more information on how to use this attribute.
sret(<ty>)
This indicates that the pointer parameter specifies the address of a structure that is the return value of the function in the source program. This pointer must be guaranteed by the caller to be valid: loads and stores to the structure may be assumed by the callee not to trap and to be properly aligned. This is not a valid attribute for return values.
The sret type argument specifies the in memory type, which must be the same as the pointee type of the argument.
elementtype(<ty>)
The
elementtype
argument attribute can be used to specify a pointer element type in a way that is compatible with opaque pointers.The
elementtype
attribute by itself does not carry any specific semantics. However, certain intrinsics may require this attribute to be present and assign it particular semantics. This will be documented on individual intrinsics.The attribute may only be applied to pointer typed arguments of intrinsic calls. It cannot be applied to non-intrinsic calls, and cannot be applied to parameters on function declarations. For non-opaque pointers, the type passed to
elementtype
must match the pointer element type.
align <n>
oralign(<n>)
This indicates that the pointer value or vector of pointers has the specified alignment. If applied to a vector of pointers, all pointers (elements) have the specified alignment. If the pointer value does not have the specified alignment, poison value is returned or passed instead. The
align
attribute should be combined with thenoundef
attribute to ensure a pointer is aligned, or otherwise the behavior is undefined. Note thatalign 1
has no effect on non-byval, non-preallocated arguments.Note that this attribute has additional semantics when combined with the
byval
orpreallocated
attribute, which are documented there.
noalias
This indicates that memory locations accessed via pointer values based on the argument or return value are not also accessed, during the execution of the function, via pointer values not based on the argument or return value. This guarantee only holds for memory locations that are modified, by any means, during the execution of the function. The attribute on a return value also has additional semantics described below. The caller shares the responsibility with the callee for ensuring that these requirements are met. For further details, please see the discussion of the NoAlias response in alias analysis.
Note that this definition of
noalias
is intentionally similar to the definition ofrestrict
in C99 for function arguments.For function return values, C99’s
restrict
is not meaningful, while LLVM’snoalias
is. Furthermore, the semantics of thenoalias
attribute on return values are stronger than the semantics of the attribute when used on function arguments. On function return values, thenoalias
attribute indicates that the function acts like a system memory allocation function, returning a pointer to allocated storage disjoint from the storage for any other object accessible to the caller.
nocapture
This indicates that the callee does not capture the pointer. This is not a valid attribute for return values. This attribute applies only to the particular copy of the pointer passed in this argument. A caller could pass two copies of the same pointer with one being annotated nocapture and the other not, and the callee could validly capture through the non annotated parameter.
define void @f(ptr nocapture %a, ptr %b) {
; (capture %b)
}
call void @f(ptr @glb, ptr @glb) ; well-defined
nofree
This indicates that callee does not free the pointer argument. This is not a valid attribute for return values.
nest
This indicates that the pointer parameter can be excised using the trampoline intrinsics. This is not a valid attribute for return values and can only be applied to one parameter.
returned
This indicates that the function always returns the argument as its return value. This is a hint to the optimizer and code generator used when generating the caller, allowing value propagation, tail call optimization, and omission of register saves and restores in some cases; it is not checked or enforced when generating the callee. The parameter and the function return type must be valid operands for the bitcast instruction. This is not a valid attribute for return values and can only be applied to one parameter.
nonnull
This indicates that the parameter or return pointer is not null. This attribute may only be applied to pointer typed parameters. This is not checked or enforced by LLVM; if the parameter or return pointer is null, poison value is returned or passed instead. The
nonnull
attribute should be combined with thenoundef
attribute to ensure a pointer is not null or otherwise the behavior is undefined.dereferenceable(<n>)
This indicates that the parameter or return pointer is dereferenceable. This attribute may only be applied to pointer typed parameters. A pointer that is dereferenceable can be loaded from speculatively without a risk of trapping. The number of bytes known to be dereferenceable must be provided in parentheses. It is legal for the number of bytes to be less than the size of the pointee type. The
nonnull
attribute does not imply dereferenceability (consider a pointer to one element past the end of an array), howeverdereferenceable(<n>)
does implynonnull
inaddrspace(0)
(which is the default address space), except if thenull_pointer_is_valid
function attribute is present.n
should be a positive number. The pointer should be well defined, otherwise it is undefined behavior. This meansdereferenceable(<n>)
impliesnoundef
.dereferenceable_or_null(<n>)
This indicates that the parameter or return value isn’t both non-null and non-dereferenceable (up to
<n>
bytes) at the same time. All non-null pointers tagged withdereferenceable_or_null(<n>)
aredereferenceable(<n>)
. For address space 0dereferenceable_or_null(<n>)
implies that a pointer is exactly one ofdereferenceable(<n>)
ornull
, and in other address spacesdereferenceable_or_null(<n>)
implies that a pointer is at least one ofdereferenceable(<n>)
ornull
(i.e. it may be bothnull
anddereferenceable(<n>)
). This attribute may only be applied to pointer typed parameters.swiftself
This indicates that the parameter is the self/context parameter. This is not a valid attribute for return values and can only be applied to one parameter.
swiftasync
This indicates that the parameter is the asynchronous context parameter and triggers the creation of a target-specific extended frame record to store this pointer. This is not a valid attribute for return values and can only be applied to one parameter.
swifterror
This attribute is motivated to model and optimize Swift error handling. It can be applied to a parameter with pointer to pointer type or a pointer-sized alloca. At the call site, the actual argument that corresponds to a
swifterror
parameter has to come from aswifterror
alloca or theswifterror
parameter of the caller. Aswifterror
value (either the parameter or the alloca) can only be loaded and stored from, or used as aswifterror
argument. This is not a valid attribute for return values and can only be applied to one parameter.These constraints allow the calling convention to optimize access to
swifterror
variables by associating them with a specific register at call boundaries rather than placing them in memory. Since this does change the calling convention, a function which uses theswifterror
attribute on a parameter is not ABI-compatible with one which does not.These constraints also allow LLVM to assume that a
swifterror
argument does not alias any other memory visible within a function and that aswifterror
alloca passed as an argument does not escape.immarg
This indicates the parameter is required to be an immediate value. This must be a trivial immediate integer or floating-point constant. Undef or constant expressions are not valid. This is only valid on intrinsic declarations and cannot be applied to a call site or arbitrary function.
noundef
This attribute applies to parameters and return values. If the value representation contains any undefined or poison bits, the behavior is undefined. Note that this does not refer to padding introduced by the type’s storage representation.
nofpclass(<test mask>)
This attribute applies to parameters and return values with floating-point and vector of floating-point types, as well as arrays of such types. The test mask has the same format as the second argument to the llvm.is.fpclass, and indicates which classes of floating-point values are not permitted for the value. For example a bitmask of 3 indicates the parameter may not be a NaN.
If the value is a floating-point class indicated by the
nofpclass
test mask, a poison value is passed or returned instead.
@llvm.is.fpclass(nofpclass(test_mask) %x, test_mask) => false
@llvm.is.fpclass(nofpclass(test_mask) %x, ~test_mask) => true
nofpclass(all) => poison
In textual IR, various string names are supported for readability and can be combined. For example
nofpclass(nan pinf nzero)
evaluates to a mask of 547.This does not depend on the floating-point environment. For example, a function parameter marked
nofpclass(zero)
indicates no zero inputs. If this is applied to an argument in a function marked with “denormal-fp-math” indicating zero treatment of input denormals, it does not imply the value cannot be a denormal value which would compare equal to 0.
Name |
floating-point class |
Bitmask value |
---|---|---|
nan |
Any NaN |
3 |
inf |
+/- infinity |
516 |
norm |
+/- normal |
26 |
sub |
+/- subnormal |
144 |
zero |
+/- 0 |
96 |
all |
All values |
1023 |
snan |
Signaling NaN |
1 |
qnan |
Quiet NaN |
2 |
ninf |
Negative infinity |
4 |
nnorm |
Negative normal |
8 |
nsub |
Negative subnormal |
16 |
nzero |
Negative zero |
32 |
pzero |
Positive zero |
64 |
psub |
Positive subnormal |
128 |
pnorm |
Positive normal |
256 |
pinf |
Positive infinity |
512 |
alignstack(<n>)
This indicates the alignment that should be considered by the backend when assigning this parameter to a stack slot during calling convention lowering. The enforcement of the specified alignment is target-dependent, as target-specific calling convention rules may override this value. This attribute serves the purpose of carrying language specific alignment information that is not mapped to base types in the backend (for example, over-alignment specification through language attributes).
allocalign
The function parameter marked with this attribute is the alignment in bytes of the newly allocated block returned by this function. The returned value must either have the specified alignment or be the null pointer. The return value MAY be more aligned than the requested alignment, but not less aligned. Invalid (e.g. non-power-of-2) alignments are permitted for the allocalign parameter, so long as the returned pointer is null. This attribute may only be applied to integer parameters.
allocptr
The function parameter marked with this attribute is the pointer that will be manipulated by the allocator. For a realloc-like function the pointer will be invalidated upon success (but the same address may be returned), for a free-like function the pointer will always be invalidated.
readnone
This attribute indicates that the function does not dereference that pointer argument, even though it may read or write the memory that the pointer points to if accessed through other pointers.
If a function reads from or writes to a readnone pointer argument, the behavior is undefined.
readonly
This attribute indicates that the function does not write through this pointer argument, even though it may write to the memory that the pointer points to.
If a function writes to a readonly pointer argument, the behavior is undefined.
writeonly
This attribute indicates that the function may write to, but does not read through this pointer argument (even though it may read from the memory that the pointer points to).
If a function reads from a writeonly pointer argument, the behavior is undefined.
writable
This attribute is only meaningful in conjunction with
dereferenceable(N)
or another attribute that implies the firstN
bytes of the pointer argument are dereferenceable.In that case, the attribute indicates that the first
N
bytes will be (non-atomically) loaded and stored back on entry to the function.This implies that it’s possible to introduce spurious stores on entry to the function without introducing traps or data races. This does not necessarily hold throughout the whole function, as the pointer may escape to a different thread during the execution of the function. See also the atomic optimization guide
The “other attributes” that imply dereferenceability are
dereferenceable_or_null
(if the pointer is non-null) and thesret
,byval
,byref
,inalloca
,preallocated
family of attributes. Note that not all of these combinations are useful, e.g.byval
arguments are known to be writable even without this attribute.The
writable
attribute cannot be combined withreadnone
,readonly
or amemory
attribute that does not containargmem: write
.dead_on_unwind
At a high level, this attribute indicates that the pointer argument is dead if the call unwinds, in the sense that the caller will not depend on the contents of the memory. Stores that would only be visible on the unwind path can be elided.
More precisely, the behavior is as-if any memory written through the pointer during the execution of the function is overwritten with a poison value on unwind. This includes memory written by the implicit write implied by the
writable
attribute. The caller is allowed to access the affected memory, but all loads that are not preceded by a store will return poison.This attribute cannot be applied to return values.
Garbage Collector Strategy Names¶
Each function may specify a garbage collector strategy name, which is simply a string:
define void @f() gc "name" { ... }
The supported values of name includes those built in to LLVM and any provided by loaded plugins. Specifying a GC strategy will cause the compiler to alter its output in order to support the named garbage collection algorithm. Note that LLVM itself does not contain a garbage collector, this functionality is restricted to generating machine code which can interoperate with a collector provided externally.
Prefix Data¶
Prefix data is data associated with a function which the code generator will emit immediately before the function’s entrypoint. The purpose of this feature is to allow frontends to associate language-specific runtime metadata with specific functions and make it available through the function pointer while still allowing the function pointer to be called.
To access the data for a given function, a program may bitcast the
function pointer to a pointer to the constant’s type and dereference
index -1. This implies that the IR symbol points just past the end of
the prefix data. For instance, take the example of a function annotated
with a single i32
,
define void @f() prefix i32 123 { ... }
The prefix data can be referenced as,
%a = getelementptr inbounds i32, ptr @f, i32 -1
%b = load i32, ptr %a
Prefix data is laid out as if it were an initializer for a global variable of the prefix data’s type. The function will be placed such that the beginning of the prefix data is aligned. This means that if the size of the prefix data is not a multiple of the alignment size, the function’s entrypoint will not be aligned. If alignment of the function’s entrypoint is desired, padding must be added to the prefix data.
A function may have prefix data but no body. This has similar semantics
to the available_externally
linkage in that the data may be used by the
optimizers but will not be emitted in the object file.
Prologue Data¶
The prologue
attribute allows arbitrary code (encoded as bytes) to
be inserted prior to the function body. This can be used for enabling
function hot-patching and instrumentation.
To maintain the semantics of ordinary function calls, the prologue data must have a particular format. Specifically, it must begin with a sequence of bytes which decode to a sequence of machine instructions, valid for the module’s target, which transfer control to the point immediately succeeding the prologue data, without performing any other visible action. This allows the inliner and other passes to reason about the semantics of the function definition without needing to reason about the prologue data. Obviously this makes the format of the prologue data highly target dependent.
A trivial example of valid prologue data for the x86 architecture is i8 144
,
which encodes the nop
instruction:
define void @f() prologue i8 144 { ... }
Generally prologue data can be formed by encoding a relative branch instruction
which skips the metadata, as in this example of valid prologue data for the
x86_64 architecture, where the first two bytes encode jmp .+10
:
%0 = type <{ i8, i8, ptr }>
define void @f() prologue %0 <{ i8 235, i8 8, ptr @md}> { ... }
A function may have prologue data but no body. This has similar semantics
to the available_externally
linkage in that the data may be used by the
optimizers but will not be emitted in the object file.
Personality Function¶
The personality
attribute permits functions to specify what function
to use for exception handling.
Attribute Groups¶
Attribute groups are groups of attributes that are referenced by objects within
the IR. They are important for keeping .ll
files readable, because a lot of
functions will use the same set of attributes. In the degenerative case of a
.ll
file that corresponds to a single .c
file, the single attribute
group will capture the important command line flags used to build that file.
An attribute group is a module-level object. To use an attribute group, an
object references the attribute group’s ID (e.g. #37
). An object may refer
to more than one attribute group. In that situation, the attributes from the
different groups are merged.
Here is an example of attribute groups for a function that should always be inlined, has a stack alignment of 4, and which shouldn’t use SSE instructions:
; Target-independent attributes:
attributes #0 = { alwaysinline alignstack=4 }
; Target-dependent attributes:
attributes #1 = { "no-sse" }
; Function @f has attributes: alwaysinline, alignstack=4, and "no-sse".
define void @f() #0 #1 { ... }
Function Attributes¶
Function attributes are set to communicate additional information about a function. Function attributes are considered to be part of the function, not of the function type, so functions with different function attributes can have the same function type.
Function attributes are simple keywords that follow the type specified. If multiple attributes are needed, they are space separated. For example:
define void @f() noinline { ... }
define void @f() alwaysinline { ... }
define void @f() alwaysinline optsize { ... }
define void @f() optsize { ... }
alignstack(<n>)
This attribute indicates that, when emitting the prologue and epilogue, the backend should forcibly align the stack pointer. Specify the desired alignment, which must be a power of two, in parentheses.
"alloc-family"="FAMILY"
This indicates which “family” an allocator function is part of. To avoid collisions, the family name should match the mangled name of the primary allocator function, that is “malloc” for malloc/calloc/realloc/free, “_Znwm” for
::operator::new
and::operator::delete
, and “_ZnwmSt11align_val_t” for aligned::operator::new
and::operator::delete
. Matching malloc/realloc/free calls within a family can be optimized, but mismatched ones will be left alone.allockind("KIND")
Describes the behavior of an allocation function. The KIND string contains comma separated entries from the following options:
“alloc”: the function returns a new block of memory or null.
“realloc”: the function returns a new block of memory or null. If the result is non-null the memory contents from the start of the block up to the smaller of the original allocation size and the new allocation size will match that of the
allocptr
argument and theallocptr
argument is invalidated, even if the function returns the same address.“free”: the function frees the block of memory specified by
allocptr
. Functions marked as “free”allockind
must return void.“uninitialized”: Any newly-allocated memory (either a new block from a “alloc” function or the enlarged capacity from a “realloc” function) will be uninitialized.
“zeroed”: Any newly-allocated memory (either a new block from a “alloc” function or the enlarged capacity from a “realloc” function) will be zeroed.
“aligned”: the function returns memory aligned according to the
allocalign
parameter.
The first three options are mutually exclusive, and the remaining options describe more details of how the function behaves. The remaining options are invalid for “free”-type functions.
allocsize(<EltSizeParam>[, <NumEltsParam>])
This attribute indicates that the annotated function will always return at least a given number of bytes (or null). Its arguments are zero-indexed parameter numbers; if one argument is provided, then it’s assumed that at least
CallSite.Args[EltSizeParam]
bytes will be available at the returned pointer. If two are provided, then it’s assumed thatCallSite.Args[EltSizeParam] * CallSite.Args[NumEltsParam]
bytes are available. The referenced parameters must be integer types. No assumptions are made about the contents of the returned block of memory.alwaysinline
This attribute indicates that the inliner should attempt to inline this function into callers whenever possible, ignoring any active inlining size threshold for this caller.
builtin
This indicates that the callee function at a call site should be recognized as a built-in function, even though the function’s declaration uses the
nobuiltin
attribute. This is only valid at call sites for direct calls to functions that are declared with thenobuiltin
attribute.cold
This attribute indicates that this function is rarely called. When computing edge weights, basic blocks post-dominated by a cold function call are also considered to be cold; and, thus, given low weight.
convergent
This attribute indicates that this function is convergent. When it appears on a call/invoke, the convergent attribute indicates that we should treat the call as though we’re calling a convergent function. This is particularly useful on indirect calls; without this we may treat such calls as though the target is non-convergent.
See Convergent Operation Semantics for further details.
It is an error to call llvm.experimental.convergence.entry from a function that does not have this attribute.
disable_sanitizer_instrumentation
When instrumenting code with sanitizers, it can be important to skip certain functions to ensure no instrumentation is applied to them.
This attribute is not always similar to absent
sanitize_<name>
attributes: depending on the specific sanitizer, code can be inserted into functions regardless of thesanitize_<name>
attribute to prevent false positive reports.disable_sanitizer_instrumentation
disables all kinds of instrumentation, taking precedence over thesanitize_<name>
attributes and other compiler flags."dontcall-error"
This attribute denotes that an error diagnostic should be emitted when a call of a function with this attribute is not eliminated via optimization. Front ends can provide optional
srcloc
metadata nodes on call sites of such callees to attach information about where in the source language such a call came from. A string value can be provided as a note."dontcall-warn"
This attribute denotes that a warning diagnostic should be emitted when a call of a function with this attribute is not eliminated via optimization. Front ends can provide optional
srcloc
metadata nodes on call sites of such callees to attach information about where in the source language such a call came from. A string value can be provided as a note.fn_ret_thunk_extern
This attribute tells the code generator that returns from functions should be replaced with jumps to externally-defined architecture-specific symbols. For X86, this symbol’s identifier is
__x86_return_thunk
."frame-pointer"
This attribute tells the code generator whether the function should keep the frame pointer. The code generator may emit the frame pointer even if this attribute says the frame pointer can be eliminated. The allowed string values are:
"none"
(default) - the frame pointer can be eliminated."non-leaf"
- the frame pointer should be kept if the function calls other functions."all"
- the frame pointer should be kept.
hot
This attribute indicates that this function is a hot spot of the program execution. The function will be optimized more aggressively and will be placed into special subsection of the text section to improving locality.
When profile feedback is enabled, this attribute has the precedence over the profile information. By marking a function
hot
, users can work around the cases where the training input does not have good coverage on all the hot functions.inlinehint
This attribute indicates that the source code contained a hint that inlining this function is desirable (such as the “inline” keyword in C/C++). It is just a hint; it imposes no requirements on the inliner.
jumptable
This attribute indicates that the function should be added to a jump-instruction table at code-generation time, and that all address-taken references to this function should be replaced with a reference to the appropriate jump-instruction-table function pointer. Note that this creates a new pointer for the original function, which means that code that depends on function-pointer identity can break. So, any function annotated with
jumptable
must also beunnamed_addr
.memory(...)
This attribute specifies the possible memory effects of the call-site or function. It allows specifying the possible access kinds (
none
,read
,write
, orreadwrite
) for the possible memory location kinds (argmem
,inaccessiblemem
, as well as a default). It is best understood by example:memory(none)
: Does not access any memory.memory(read)
: May read (but not write) any memory.memory(write)
: May write (but not read) any memory.memory(readwrite)
: May read or write any memory.memory(argmem: read)
: May only read argument memory.memory(argmem: read, inaccessiblemem: write)
: May only read argument memory and only write inaccessible memory.memory(read, argmem: readwrite)
: May read any memory (default mode) and additionally write argument memory.memory(readwrite, argmem: none)
: May access any memory apart from argument memory.
The supported memory location kinds are:
argmem
: This refers to accesses that are based on pointer arguments to the function.inaccessiblemem
: This refers to accesses to memory which is not accessible by the current module (before return from the function – an allocator function may return newly accessible memory while only accessing inaccessible memory itself). Inaccessible memory is often used to model control dependencies of intrinsics.The default access kind (specified without a location prefix) applies to all locations that haven’t been specified explicitly, including those that don’t currently have a dedicated location kind (e.g. accesses to globals or captured pointers).
If the
memory
attribute is not specified, thenmemory(readwrite)
is implied (all memory effects are possible).The memory effects of a call can be computed as
CallSiteEffects & (FunctionEffects | OperandBundleEffects)
. Thus, the call-site annotation takes precedence over the potential effects described by either the function annotation or the operand bundles.minsize
This attribute suggests that optimization passes and code generator passes make choices that keep the code size of this function as small as possible and perform optimizations that may sacrifice runtime performance in order to minimize the size of the generated code. This attribute is incompatible with the
optdebug
andoptnone
attributes.naked
This attribute disables prologue / epilogue emission for the function. This can have very system-specific consequences.
"no-inline-line-tables"
When this attribute is set to true, the inliner discards source locations when inlining code and instead uses the source location of the call site. Breakpoints set on code that was inlined into the current function will not fire during the execution of the inlined call sites. If the debugger stops inside an inlined call site, it will appear to be stopped at the outermost inlined call site.
no-jump-tables
When this attribute is set to true, the jump tables and lookup tables that can be generated from a switch case lowering are disabled.
nobuiltin
This indicates that the callee function at a call site is not recognized as a built-in function. LLVM will retain the original call and not replace it with equivalent code based on the semantics of the built-in function, unless the call site uses the
builtin
attribute. This is valid at call sites and on function declarations and definitions.nocallback
This attribute indicates that the function is only allowed to jump back into caller’s module by a return or an exception, and is not allowed to jump back by invoking a callback function, a direct, possibly transitive, external function call, use of
longjmp
, or other means. It is a compiler hint that is used at module level to improve dataflow analysis, dropped during linking, and has no effect on functions defined in the current module.noduplicate
This attribute indicates that calls to the function cannot be duplicated. A call to a
noduplicate
function may be moved within its parent function, but may not be duplicated within its parent function.A function containing a
noduplicate
call may still be an inlining candidate, provided that the call is not duplicated by inlining. That implies that the function has internal linkage and only has one call site, so the original call is dead after inlining.nofree
This function attribute indicates that the function does not, directly or transitively, call a memory-deallocation function (
free
, for example) on a memory allocation which existed before the call.As a result, uncaptured pointers that are known to be dereferenceable prior to a call to a function with the
nofree
attribute are still known to be dereferenceable after the call. The capturing condition is necessary in environments where the function might communicate the pointer to another thread which then deallocates the memory. Alternatively,nosync
would ensure such communication cannot happen and even captured pointers cannot be freed by the function.A
nofree
function is explicitly allowed to free memory which it allocated or (if notnosync
) arrange for another thread to free memory on it’s behalf. As a result, perhaps surprisingly, anofree
function can return a pointer to a previously deallocated memory object.noimplicitfloat
Disallows implicit floating-point code. This inhibits optimizations that use floating-point code and floating-point registers for operations that are not nominally floating-point. LLVM instructions that perform floating-point operations or require access to floating-point registers may still cause floating-point code to be generated.
Also inhibits optimizations that create SIMD/vector code and registers from scalar code such as vectorization or memcpy/memset optimization. This includes integer vectors. Vector instructions present in IR may still cause vector code to be generated.
noinline
This attribute indicates that the inliner should never inline this function in any situation. This attribute may not be used together with the
alwaysinline
attribute.nomerge
This attribute indicates that calls to this function should never be merged during optimization. For example, it will prevent tail merging otherwise identical code sequences that raise an exception or terminate the program. Tail merging normally reduces the precision of source location information, making stack traces less useful for debugging. This attribute gives the user control over the tradeoff between code size and debug information precision.
nonlazybind
This attribute suppresses lazy symbol binding for the function. This may make calls to the function faster, at the cost of extra program startup time if the function is not called during program startup.
noprofile
This function attribute prevents instrumentation based profiling, used for coverage or profile based optimization, from being added to a function. It also blocks inlining if the caller and callee have different values of this attribute.
skipprofile
This function attribute prevents instrumentation based profiling, used for coverage or profile based optimization, from being added to a function. This attribute does not restrict inlining, so instrumented instruction could end up in this function.
noredzone
This attribute indicates that the code generator should not use a red zone, even if the target-specific ABI normally permits it.
indirect-tls-seg-refs
This attribute indicates that the code generator should not use direct TLS access through segment registers, even if the target-specific ABI normally permits it.
noreturn
This function attribute indicates that the function never returns normally, hence through a return instruction. This produces undefined behavior at runtime if the function ever does dynamically return. Annotated functions may still raise an exception, i.a.,
nounwind
is not implied.norecurse
This function attribute indicates that the function does not call itself either directly or indirectly down any possible call path. This produces undefined behavior at runtime if the function ever does recurse.
willreturn
This function attribute indicates that a call of this function will either exhibit undefined behavior or comes back and continues execution at a point in the existing call stack that includes the current invocation. Annotated functions may still raise an exception, i.a.,
nounwind
is not implied. If an invocation of an annotated function does not return control back to a point in the call stack, the behavior is undefined.nosync
This function attribute indicates that the function does not communicate (synchronize) with another thread through memory or other well-defined means. Synchronization is considered possible in the presence of atomic accesses that enforce an order, thus not “unordered” and “monotonic”, volatile accesses, as well as convergent function calls.
Note that convergent operations can involve communication that is considered to be not through memory and does not necessarily imply an ordering between threads for the purposes of the memory model. Therefore, an operation can be both convergent and nosync.
If a nosync function does ever synchronize with another thread, the behavior is undefined.
nounwind
This function attribute indicates that the function never raises an exception. If the function does raise an exception, its runtime behavior is undefined. However, functions marked nounwind may still trap or generate asynchronous exceptions. Exception handling schemes that are recognized by LLVM to handle asynchronous exceptions, such as SEH, will still provide their implementation defined semantics.
nosanitize_bounds
This attribute indicates that bounds checking sanitizer instrumentation is disabled for this function.
nosanitize_coverage
This attribute indicates that SanitizerCoverage instrumentation is disabled for this function.
null_pointer_is_valid
If
null_pointer_is_valid
is set, then thenull
address in address-space 0 is considered to be a valid address for memory loads and stores. Any analysis or optimization should not treat dereferencing a pointer tonull
as undefined behavior in this function. Note: Comparing address of a global variable tonull
may still evaluate to false because of a limitation in querying this attribute inside constant expressions.optdebug
This attribute suggests that optimization passes and code generator passes should make choices that try to preserve debug info without significantly degrading runtime performance. This attribute is incompatible with the
minsize
,optsize
, andoptnone
attributes.optforfuzzing
This attribute indicates that this function should be optimized for maximum fuzzing signal.
optnone
This function attribute indicates that most optimization passes will skip this function, with the exception of interprocedural optimization passes. Code generation defaults to the “fast” instruction selector. This attribute cannot be used together with the
alwaysinline
attribute; this attribute is also incompatible with theminsize
,optsize
, andoptdebug
attributes.This attribute requires the
noinline
attribute to be specified on the function as well, so the function is never inlined into any caller. Only functions with thealwaysinline
attribute are valid candidates for inlining into the body of this function.optsize
This attribute suggests that optimization passes and code generator passes make choices that keep the code size of this function low, and otherwise do optimizations specifically to reduce code size as long as they do not significantly impact runtime performance. This attribute is incompatible with the
optdebug
andoptnone
attributes."patchable-function"
This attribute tells the code generator that the code generated for this function needs to follow certain conventions that make it possible for a runtime function to patch over it later. The exact effect of this attribute depends on its string value, for which there currently is one legal possibility:
"prologue-short-redirect"
- This style of patchable function is intended to support patching a function prologue to redirect control away from the function in a thread safe manner. It guarantees that the first instruction of the function will be large enough to accommodate a short jump instruction, and will be sufficiently aligned to allow being fully changed via an atomic compare-and-swap instruction. While the first requirement can be satisfied by inserting large enough NOP, LLVM can and will try to re-purpose an existing instruction (i.e. one that would have to be emitted anyway) as the patchable instruction larger than a short jump."prologue-short-redirect"
is currently only supported on x86-64.
This attribute by itself does not imply restrictions on inter-procedural optimizations. All of the semantic effects the patching may have to be separately conveyed via the linkage type.
"probe-stack"
This attribute indicates that the function will trigger a guard region in the end of the stack. It ensures that accesses to the stack must be no further apart than the size of the guard region to a previous access of the stack. It takes one required string value, the name of the stack probing function that will be called.
If a function that has a
"probe-stack"
attribute is inlined into a function with another"probe-stack"
attribute, the resulting function has the"probe-stack"
attribute of the caller. If a function that has a"probe-stack"
attribute is inlined into a function that has no"probe-stack"
attribute at all, the resulting function has the"probe-stack"
attribute of the callee."stack-probe-size"
This attribute controls the behavior of stack probes: either the
"probe-stack"
attribute, or ABI-required stack probes, if any. It defines the size of the guard region. It ensures that if the function may use more stack space than the size of the guard region, stack probing sequence will be emitted. It takes one required integer value, which is 4096 by default.If a function that has a
"stack-probe-size"
attribute is inlined into a function with another"stack-probe-size"
attribute, the resulting function has the"stack-probe-size"
attribute that has the lower numeric value. If a function that has a"stack-probe-size"
attribute is inlined into a function that has no"stack-probe-size"
attribute at all, the resulting function has the"stack-probe-size"
attribute of the callee."no-stack-arg-probe"
This attribute disables ABI-required stack probes, if any.
returns_twice
This attribute indicates that this function can return twice. The C
setjmp
is an example of such a function. The compiler disables some optimizations (like tail calls) in the caller of these functions.safestack
This attribute indicates that SafeStack protection is enabled for this function.
If a function that has a
safestack
attribute is inlined into a function that doesn’t have asafestack
attribute or which has anssp
,sspstrong
orsspreq
attribute, then the resulting function will have asafestack
attribute.sanitize_address
This attribute indicates that AddressSanitizer checks (dynamic address safety analysis) are enabled for this function.
sanitize_memory
This attribute indicates that MemorySanitizer checks (dynamic detection of accesses to uninitialized memory) are enabled for this function.
sanitize_thread
This attribute indicates that ThreadSanitizer checks (dynamic thread safety analysis) are enabled for this function.
sanitize_hwaddress
This attribute indicates that HWAddressSanitizer checks (dynamic address safety analysis based on tagged pointers) are enabled for this function.
sanitize_memtag
This attribute indicates that MemTagSanitizer checks (dynamic address safety analysis based on Armv8 MTE) are enabled for this function.
speculative_load_hardening
This attribute indicates that Speculative Load Hardening should be enabled for the function body.
Speculative Load Hardening is a best-effort mitigation against information leak attacks that make use of control flow miss-speculation - specifically miss-speculation of whether a branch is taken or not. Typically vulnerabilities enabling such attacks are classified as “Spectre variant #1”. Notably, this does not attempt to mitigate against miss-speculation of branch target, classified as “Spectre variant #2” vulnerabilities.
When inlining, the attribute is sticky. Inlining a function that carries this attribute will cause the caller to gain the attribute. This is intended to provide a maximally conservative model where the code in a function annotated with this attribute will always (even after inlining) end up hardened.
speculatable
This function attribute indicates that the function does not have any effects besides calculating its result and does not have undefined behavior. Note that
speculatable
is not enough to conclude that along any particular execution path the number of calls to this function will not be externally observable. This attribute is only valid on functions and declarations, not on individual call sites. If a function is incorrectly marked as speculatable and really does exhibit undefined behavior, the undefined behavior may be observed even if the call site is dead code.ssp
This attribute indicates that the function should emit a stack smashing protector. It is in the form of a “canary” — a random value placed on the stack before the local variables that’s checked upon return from the function to see if it has been overwritten. A heuristic is used to determine if a function needs stack protectors or not. The heuristic used will enable protectors for functions with:
Character arrays larger than
ssp-buffer-size
(default 8).Aggregates containing character arrays larger than
ssp-buffer-size
.Calls to alloca() with variable sizes or constant sizes greater than
ssp-buffer-size
.
Variables that are identified as requiring a protector will be arranged on the stack such that they are adjacent to the stack protector guard.
If a function with an
ssp
attribute is inlined into a calling function, the attribute is not carried over to the calling function.sspstrong
This attribute indicates that the function should emit a stack smashing protector. This attribute causes a strong heuristic to be used when determining if a function needs stack protectors. The strong heuristic will enable protectors for functions with:
Arrays of any size and type
Aggregates containing an array of any size and type.
Calls to alloca().
Local variables that have had their address taken.
Variables that are identified as requiring a protector will be arranged on the stack such that they are adjacent to the stack protector guard. The specific layout rules are:
Large arrays and structures containing large arrays (
>= ssp-buffer-size
) are closest to the stack protector.Small arrays and structures containing small arrays (
< ssp-buffer-size
) are 2nd closest to the protector.Variables that have had their address taken are 3rd closest to the protector.
This overrides the
ssp
function attribute.If a function with an
sspstrong
attribute is inlined into a calling function which has anssp
attribute, the calling function’s attribute will be upgraded tosspstrong
.sspreq
This attribute indicates that the function should always emit a stack smashing protector. This overrides the
ssp
andsspstrong
function attributes.Variables that are identified as requiring a protector will be arranged on the stack such that they are adjacent to the stack protector guard. The specific layout rules are:
Large arrays and structures containing large arrays (
>= ssp-buffer-size
) are closest to the stack protector.Small arrays and structures containing small arrays (
< ssp-buffer-size
) are 2nd closest to the protector.Variables that have had their address taken are 3rd closest to the protector.
If a function with an
sspreq
attribute is inlined into a calling function which has anssp
orsspstrong
attribute, the calling function’s attribute will be upgraded tosspreq
.strictfp
This attribute indicates that the function was called from a scope that requires strict floating-point semantics. LLVM will not attempt any optimizations that require assumptions about the floating-point rounding mode or that might alter the state of floating-point status flags that might otherwise be set or cleared by calling this function. LLVM will not introduce any new floating-point instructions that may trap.
"denormal-fp-math"
This indicates the denormal (subnormal) handling that may be assumed for the default floating-point environment. This is a comma separated pair. The elements may be one of
"ieee"
,"preserve-sign"
,"positive-zero"
, or"dynamic"
. The first entry indicates the flushing mode for the result of floating point operations. The second indicates the handling of denormal inputs to floating point instructions. For compatibility with older bitcode, if the second value is omitted, both input and output modes will assume the same mode.If this is attribute is not specified, the default is
"ieee,ieee"
.If the output mode is
"preserve-sign"
, or"positive-zero"
, denormal outputs may be flushed to zero by standard floating-point operations. It is not mandated that flushing to zero occurs, but if a denormal output is flushed to zero, it must respect the sign mode. Not all targets support all modes.If the mode is
"dynamic"
, the behavior is derived from the dynamic state of the floating-point environment. Transformations which depend on the behavior of denormal values should not be performed.While this indicates the expected floating point mode the function will be executed with, this does not make any attempt to ensure the mode is consistent. User or platform code is expected to set the floating point mode appropriately before function entry.
If the input mode is
"preserve-sign"
, or"positive-zero"
, a floating-point operation must treat any input denormal value as zero. In some situations, if an instruction does not respect this mode, the input may need to be converted to 0 as if by@llvm.canonicalize
during lowering for correctness."denormal-fp-math-f32"
Same as
"denormal-fp-math"
, but only controls the behavior of the 32-bit float type (or vectors of 32-bit floats). If both are are present, this overrides"denormal-fp-math"
. Not all targets support separately setting the denormal mode per type, and no attempt is made to diagnose unsupported uses. Currently this attribute is respected by the AMDGPU and NVPTX backends."thunk"
This attribute indicates that the function will delegate to some other function with a tail call. The prototype of a thunk should not be used for optimization purposes. The caller is expected to cast the thunk prototype to match the thunk target prototype.
"tls-load-hoist"
This attribute indicates that the function will try to reduce redundant tls address calculation by hoisting tls variable.
uwtable[(sync|async)]
This attribute indicates that the ABI being targeted requires that an unwind table entry be produced for this function even if we can show that no exceptions passes by it. This is normally the case for the ELF x86-64 abi, but it can be disabled for some compilation units. The optional parameter describes what kind of unwind tables to generate:
sync
for normal unwind tables,async
for asynchronous (instruction precise) unwind tables. Without the parameter, the attributeuwtable
is equivalent touwtable(async)
.nocf_check
This attribute indicates that no control-flow check will be performed on the attributed entity. It disables -fcf-protection=<> for a specific entity to fine grain the HW control flow protection mechanism. The flag is target independent and currently appertains to a function or function pointer.
shadowcallstack
This attribute indicates that the ShadowCallStack checks are enabled for the function. The instrumentation checks that the return address for the function has not changed between the function prolog and epilog. It is currently x86_64-specific.
mustprogress
This attribute indicates that the function is required to return, unwind, or interact with the environment in an observable way e.g. via a volatile memory access, I/O, or other synchronization. The
mustprogress
attribute is intended to model the requirements of the first section of [intro.progress] of the C++ Standard. As a consequence, a loop in a function with the mustprogress attribute can be assumed to terminate if it does not interact with the environment in an observable way, and terminating loops without side-effects can be removed. If a mustprogress function does not satisfy this contract, the behavior is undefined. This attribute does not apply transitively to callees, but does apply to call sites within the function. Note that willreturn implies mustprogress."warn-stack-size"="<threshold>"
This attribute sets a threshold to emit diagnostics once the frame size is known should the frame size exceed the specified value. It takes one required integer value, which should be a non-negative integer, and less than UINT_MAX. It’s unspecified which threshold will be used when duplicate definitions are linked together with differing values.
vscale_range(<min>[, <max>])
This function attribute indicates vscale is a power-of-two within a specified range. min must be a power-of-two that is greater than 0. When specified, max must be a power-of-two greater-than-or-equal to min or 0 to signify an unbounded maximum. The syntax vscale_range(<val>) can be used to set both min and max to the same value. Functions that don’t include this attribute make no assumptions about the value of vscale.
"nooutline"
This attribute indicates that outlining passes should not modify the function.
Call Site Attributes¶
In addition to function attributes the following call site only attributes are supported:
vector-function-abi-variant
This attribute can be attached to a call to list the vector functions associated to the function. Notice that the attribute cannot be attached to a invoke or a callbr instruction. The attribute consists of a comma separated list of mangled names. The order of the list does not imply preference (it is logically a set). The compiler is free to pick any listed vector function of its choosing.
The syntax for the mangled names is as follows::
_ZGV<isa><mask><vlen><parameters>_<scalar_name>[(<vector_redirection>)]
When present, the attribute informs the compiler that the function
<scalar_name>
has a corresponding vector variant that can be used to perform the concurrent invocation of<scalar_name>
on vectors. The shape of the vector function is described by the tokens between the prefix_ZGV
and the<scalar_name>
token. The standard name of the vector function is_ZGV<isa><mask><vlen><parameters>_<scalar_name>
. When present, the optional token(<vector_redirection>)
informs the compiler that a custom name is provided in addition to the standard one (custom names can be provided for example via the use ofdeclare variant
in OpenMP 5.0). The declaration of the variant must be present in the IR Module. The signature of the vector variant is determined by the rules of the Vector Function ABI (VFABI) specifications of the target. For Arm and X86, the VFABI can be found at https://github.com/ARM-software/abi-aa and https://software.intel.com/content/www/us/en/develop/download/vector-simd-function-abi.html, respectively.For X86 and Arm targets, the values of the tokens in the standard name are those that are defined in the VFABI. LLVM has an internal
<isa>
token that can be used to create scalar-to-vector mappings for functions that are not directly associated to any of the target ISAs (for example, some of the mappings stored in the TargetLibraryInfo). Valid values for the<isa>
token are::<isa>:= b | c | d | e -> X86 SSE, AVX, AVX2, AVX512 | n | s -> Armv8 Advanced SIMD, SVE | __LLVM__ -> Internal LLVM Vector ISA
For all targets currently supported (x86, Arm and Internal LLVM), the remaining tokens can have the following values::
<mask>:= M | N -> mask | no mask <vlen>:= number -> number of lanes | x -> VLA (Vector Length Agnostic) <parameters>:= v -> vector | l | l <number> -> linear | R | R <number> -> linear with ref modifier | L | L <number> -> linear with val modifier | U | U <number> -> linear with uval modifier | ls <pos> -> runtime linear | Rs <pos> -> runtime linear with ref modifier | Ls <pos> -> runtime linear with val modifier | Us <pos> -> runtime linear with uval modifier | u -> uniform <scalar_name>:= name of the scalar function <vector_redirection>:= optional, custom name of the vector function
preallocated(<ty>)
This attribute is required on calls to
llvm.call.preallocated.arg
and cannot be used on any other call. See llvm.call.preallocated.arg for more details.
Global Attributes¶
Attributes may be set to communicate additional information about a global variable. Unlike function attributes, attributes on a global variable are grouped into a single attribute group.
no_sanitize_address
This attribute indicates that the global variable should not have AddressSanitizer instrumentation applied to it, because it was annotated with __attribute__((no_sanitize(“address”))), __attribute__((disable_sanitizer_instrumentation)), or included in the -fsanitize-ignorelist file.
no_sanitize_hwaddress
This attribute indicates that the global variable should not have HWAddressSanitizer instrumentation applied to it, because it was annotated with __attribute__((no_sanitize(“hwaddress”))), __attribute__((disable_sanitizer_instrumentation)), or included in the -fsanitize-ignorelist file.
sanitize_memtag
This attribute indicates that the global variable should have AArch64 memory tags (MTE) instrumentation applied to it. This attribute causes the suppression of certain optimisations, like GlobalMerge, as well as ensuring extra directives are emitted in the assembly and extra bits of metadata are placed in the object file so that the linker can ensure the accesses are protected by MTE. This attribute is added by clang when -fsanitize=memtag-globals is provided, as long as the global is not marked with __attribute__((no_sanitize(“memtag”))), __attribute__((disable_sanitizer_instrumentation)), or included in the -fsanitize-ignorelist file. The AArch64 Globals Tagging pass may remove this attribute when it’s not possible to tag the global (e.g. it’s a TLS variable).
sanitize_address_dyninit
This attribute indicates that the global variable, when instrumented with AddressSanitizer, should be checked for ODR violations. This attribute is applied to global variables that are dynamically initialized according to C++ rules.
Operand Bundles¶
Operand bundles are tagged sets of SSA values that can be associated
with certain LLVM instructions (currently only call
s and
invoke
s). In a way they are like metadata, but dropping them is
incorrect and will change program semantics.
Syntax:
operand bundle set ::= '[' operand bundle (, operand bundle )* ']'
operand bundle ::= tag '(' [ bundle operand ] (, bundle operand )* ')'
bundle operand ::= SSA value
tag ::= string constant
Operand bundles are not part of a function’s signature, and a
given function may be called from multiple places with different kinds
of operand bundles. This reflects the fact that the operand bundles
are conceptually a part of the call
(or invoke
), not the
callee being dispatched to.
Operand bundles are a generic mechanism intended to support runtime-introspection-like functionality for managed languages. While the exact semantics of an operand bundle depend on the bundle tag, there are certain limitations to how much the presence of an operand bundle can influence the semantics of a program. These restrictions are described as the semantics of an “unknown” operand bundle. As long as the behavior of an operand bundle is describable within these restrictions, LLVM does not need to have special knowledge of the operand bundle to not miscompile programs containing it.
The bundle operands for an unknown operand bundle escape in unknown ways before control is transferred to the callee or invokee.
Calls and invokes with operand bundles have unknown read / write effect on the heap on entry and exit (even if the call target specifies a
memory
attribute), unless they’re overridden with callsite specific attributes.An operand bundle at a call site cannot change the implementation of the called function. Inter-procedural optimizations work as usual as long as they take into account the first two properties.
More specific types of operand bundles are described below.
Deoptimization Operand Bundles¶
Deoptimization operand bundles are characterized by the "deopt"
operand bundle tag. These operand bundles represent an alternate
“safe” continuation for the call site they’re attached to, and can be
used by a suitable runtime to deoptimize the compiled frame at the
specified call site. There can be at most one "deopt"
operand
bundle attached to a call site. Exact details of deoptimization is
out of scope for the language reference, but it usually involves
rewriting a compiled frame into a set of interpreted frames.
From the compiler’s perspective, deoptimization operand bundles make
the call sites they’re attached to at least readonly
. They read
through all of their pointer typed operands (even if they’re not
otherwise escaped) and the entire visible heap. Deoptimization
operand bundles do not capture their operands except during
deoptimization, in which case control will not be returned to the
compiled frame.
The inliner knows how to inline through calls that have deoptimization
operand bundles. Just like inlining through a normal call site
involves composing the normal and exceptional continuations, inlining
through a call site with a deoptimization operand bundle needs to
appropriately compose the “safe” deoptimization continuation. The
inliner does this by prepending the parent’s deoptimization
continuation to every deoptimization continuation in the inlined body.
E.g. inlining @f
into @g
in the following example
define void @f() {
call void @x() ;; no deopt state
call void @y() [ "deopt"(i32 10) ]
call void @y() [ "deopt"(i32 10), "unknown"(ptr null) ]
ret void
}
define void @g() {
call void @f() [ "deopt"(i32 20) ]
ret void
}
will result in
define void @g() {
call void @x() ;; still no deopt state
call void @y() [ "deopt"(i32 20, i32 10) ]
call void @y() [ "deopt"(i32 20, i32 10), "unknown"(ptr null) ]
ret void
}
It is the frontend’s responsibility to structure or encode the deoptimization state in a way that syntactically prepending the caller’s deoptimization state to the callee’s deoptimization state is semantically equivalent to composing the caller’s deoptimization continuation after the callee’s deoptimization continuation.
Funclet Operand Bundles¶
Funclet operand bundles are characterized by the "funclet"
operand bundle tag. These operand bundles indicate that a call site
is within a particular funclet. There can be at most one
"funclet"
operand bundle attached to a call site and it must have
exactly one bundle operand.
If any funclet EH pads have been “entered” but not “exited” (per the
description in the EH doc),
it is undefined behavior to execute a call
or invoke
which:
does not have a
"funclet"
bundle and is not acall
to a nounwind intrinsic, orhas a
"funclet"
bundle whose operand is not the most-recently-entered not-yet-exited funclet EH pad.
Similarly, if no funclet EH pads have been entered-but-not-yet-exited,
executing a call
or invoke
with a "funclet"
bundle is undefined behavior.
GC Transition Operand Bundles¶
GC transition operand bundles are characterized by the
"gc-transition"
operand bundle tag. These operand bundles mark a
call as a transition between a function with one GC strategy to a
function with a different GC strategy. If coordinating the transition
between GC strategies requires additional code generation at the call
site, these bundles may contain any values that are needed by the
generated code. For more details, see GC Transitions.
The bundle contain an arbitrary list of Values which need to be passed to GC transition code. They will be lowered and passed as operands to the appropriate GC_TRANSITION nodes in the selection DAG. It is assumed that these arguments must be available before and after (but not necessarily during) the execution of the callee.
Assume Operand Bundles¶
Operand bundles on an llvm.assume allows representing assumptions, such as that a parameter attribute or a function attribute holds for a certain value at a certain location. Operand bundles enable assumptions that are either hard or impossible to represent as a boolean argument of an llvm.assume.
An assume operand bundle has the form:
"<tag>"([ <arguments>] ])
In the case of function or parameter attributes, the operand bundle has the restricted form:
"<tag>"([ <holds for value> [, <attribute argument>] ])
The tag of the operand bundle is usually the name of attribute that can be assumed to hold. It can also be ignore, this tag doesn’t contain any information and should be ignored.
The first argument if present is the value for which the attribute hold.
The second argument if present is an argument of the attribute.
If there are no arguments the attribute is a property of the call location.
For example:
call void @llvm.assume(i1 true) ["align"(ptr %val, i32 8)]
allows the optimizer to assume that at location of call to
llvm.assume %val
has an alignment of at least 8.
call void @llvm.assume(i1 %cond) ["cold"(), "nonnull"(ptr %val)]
allows the optimizer to assume that the llvm.assume
call location is cold and that %val
may not be null.
Just like for the argument of llvm.assume, if any of the provided guarantees are violated at runtime the behavior is undefined.
While attributes expect constant arguments, assume operand bundles may be provided a dynamic value, for example:
call void @llvm.assume(i1 true) ["align"(ptr %val, i32 %align)]
If the operand bundle value violates any requirements on the attribute value, the behavior is undefined, unless one of the following exceptions applies:
"align"
operand bundles may specify a non-power-of-two alignment (including a zero alignment). If this is the case, then the pointer value must be a null pointer, otherwise the behavior is undefined.
In addition to allowing operand bundles encoding function and parameter
attributes, an assume operand bundle my also encode a separate_storage
operand bundle. This has the form:
separate_storage(<val1>, <val2>)``
This indicates that no pointer based on one of its arguments can alias any pointer based on the other.
Even if the assumed property can be encoded as a boolean value, like
nonnull
, using operand bundles to express the property can still have
benefits:
Attributes that can be expressed via operand bundles are directly the property that the optimizer uses and cares about. Encoding attributes as operand bundles removes the need for an instruction sequence that represents the property (e.g., icmp ne ptr %p, null for nonnull) and for the optimizer to deduce the property from that instruction sequence.
Expressing the property using operand bundles makes it easy to identify the use of the value as a use in an llvm.assume. This then simplifies and improves heuristics, e.g., for use “use-sensitive” optimizations.
Preallocated Operand Bundles¶
Preallocated operand bundles are characterized by the "preallocated"
operand bundle tag. These operand bundles allow separation of the allocation
of the call argument memory from the call site. This is necessary to pass
non-trivially copyable objects by value in a way that is compatible with MSVC
on some targets. There can be at most one "preallocated"
operand bundle
attached to a call site and it must have exactly one bundle operand, which is
a token generated by @llvm.call.preallocated.setup
. A call with this
operand bundle should not adjust the stack before entering the function, as
that will have been done by one of the @llvm.call.preallocated.*
intrinsics.
%foo = type { i64, i32 }
...
%t = call token @llvm.call.preallocated.setup(i32 1)
%a = call ptr @llvm.call.preallocated.arg(token %t, i32 0) preallocated(%foo)
; initialize %b
call void @bar(i32 42, ptr preallocated(%foo) %a) ["preallocated"(token %t)]
GC Live Operand Bundles¶
A “gc-live” operand bundle is only valid on a gc.statepoint intrinsic. The operand bundle must contain every pointer to a garbage collected object which potentially needs to be updated by the garbage collector.
When lowered, any relocated value will be recorded in the corresponding stackmap entry. See the intrinsic description for further details.
ObjC ARC Attached Call Operand Bundles¶
A "clang.arc.attachedcall"
operand bundle on a call indicates the call is
implicitly followed by a marker instruction and a call to an ObjC runtime
function that uses the result of the call. The operand bundle takes a mandatory
pointer to the runtime function (@objc_retainAutoreleasedReturnValue
or
@objc_unsafeClaimAutoreleasedReturnValue
).
The return value of a call with this bundle is used by a call to
@llvm.objc.clang.arc.noop.use
unless the called function’s return type is
void, in which case the operand bundle is ignored.
; The marker instruction and a runtime function call are inserted after the call
; to @foo.
call ptr @foo() [ "clang.arc.attachedcall"(ptr @objc_retainAutoreleasedReturnValue) ]
call ptr @foo() [ "clang.arc.attachedcall"(ptr @objc_unsafeClaimAutoreleasedReturnValue) ]
The operand bundle is needed to ensure the call is immediately followed by the marker instruction and the ObjC runtime call in the final output.
Pointer Authentication Operand Bundles¶
Pointer Authentication operand bundles are characterized by the
"ptrauth"
operand bundle tag. They are described in the
Pointer Authentication document.
KCFI Operand Bundles¶
A "kcfi"
operand bundle on an indirect call indicates that the call will
be preceded by a runtime type check, which validates that the call target is
prefixed with a type identifier that matches the operand
bundle attribute. For example:
call void %0() ["kcfi"(i32 1234)]
Clang emits KCFI operand bundles and the necessary metadata with
-fsanitize=kcfi
.
Convergence Control Operand Bundles¶
A “convergencectrl” operand bundle is only valid on a convergent
operation.
When present, the operand bundle must contain exactly one value of token type.
See the Convergent Operation Semantics document for details.
Module-Level Inline Assembly¶
Modules may contain “module-level inline asm” blocks, which corresponds
to the GCC “file scope inline asm” blocks. These blocks are internally
concatenated by LLVM and treated as a single unit, but may be separated
in the .ll
file if desired. The syntax is very simple:
module asm "inline asm code goes here"
module asm "more can go here"
The strings can contain any character by escaping non-printable characters. The escape sequence used is simply “\xx” where “xx” is the two digit hex code for the number.
Note that the assembly string must be parseable by LLVM’s integrated assembler
(unless it is disabled), even when emitting a .s
file.
Data Layout¶
A module may specify a target specific data layout string that specifies how data is to be laid out in memory. The syntax for the data layout is simply:
target datalayout = "layout specification"
The layout specification consists of a list of specifications separated by the minus sign character (‘-‘). Each specification starts with a letter and may include other information after the letter to define some aspect of the data layout. The specifications accepted are as follows:
E
Specifies that the target lays out data in big-endian form. That is, the bits with the most significance have the lowest address location.
e
Specifies that the target lays out data in little-endian form. That is, the bits with the least significance have the lowest address location.
S<size>
Specifies the natural alignment of the stack in bits. Alignment promotion of stack variables is limited to the natural stack alignment to avoid dynamic stack realignment. The stack alignment must be a multiple of 8-bits. If omitted, the natural stack alignment defaults to “unspecified”, which does not prevent any alignment promotions.
P<address space>
Specifies the address space that corresponds to program memory. Harvard architectures can use this to specify what space LLVM should place things such as functions into. If omitted, the program memory space defaults to the default address space of 0, which corresponds to a Von Neumann architecture that has code and data in the same space.
G<address space>
Specifies the address space to be used by default when creating global variables. If omitted, the globals address space defaults to the default address space 0. Note: variable declarations without an address space are always created in address space 0, this property only affects the default value to be used when creating globals without additional contextual information (e.g. in LLVM passes).
A<address space>
Specifies the address space of objects created by ‘
alloca
’. Defaults to the default address space of 0.p[n]:<size>:<abi>[:<pref>][:<idx>]
This specifies the size of a pointer and its
<abi>
and<pref>
erred alignments for address spacen
.<pref>
is optional and defaults to<abi>
. The fourth parameter<idx>
is the size of the index that used for address calculation, which must be less than or equal to the pointer size. If not specified, the default index size is equal to the pointer size. All sizes are in bits. The address space,n
, is optional, and if not specified, denotes the default address space 0. The value ofn
must be in the range [1,2^24).i<size>:<abi>[:<pref>]
This specifies the alignment for an integer type of a given bit
<size>
. The value of<size>
must be in the range [1,2^24).<pref>
is optional and defaults to<abi>
. Fori8
, the<abi>
value must equal 8, that is,i8
must be naturally aligned.v<size>:<abi>[:<pref>]
This specifies the alignment for a vector type of a given bit
<size>
. The value of<size>
must be in the range [1,2^24).<pref>
is optional and defaults to<abi>
.f<size>:<abi>[:<pref>]
This specifies the alignment for a floating-point type of a given bit
<size>
. Only values of<size>
that are supported by the target will work. 32 (float) and 64 (double) are supported on all targets; 80 or 128 (different flavors of long double) are also supported on some targets. The value of<size>
must be in the range [1,2^24).<pref>
is optional and defaults to<abi>
.a:<abi>[:<pref>]
This specifies the alignment for an object of aggregate type.
<pref>
is optional and defaults to<abi>
.F<type><abi>
This specifies the alignment for function pointers. The options for
<type>
are:i
: The alignment of function pointers is independent of the alignment of functions, and is a multiple of<abi>
.n
: The alignment of function pointers is a multiple of the explicit alignment specified on the function, and is a multiple of<abi>
.
m:<mangling>
If present, specifies that llvm names are mangled in the output. Symbols prefixed with the mangling escape character
\01
are passed through directly to the assembler without the escape character. The mangling style options aree
: ELF mangling: Private symbols get a.L
prefix.l
: GOFF mangling: Private symbols get a@
prefix.m
: Mips mangling: Private symbols get a$
prefix.o
: Mach-O mangling: Private symbols getL
prefix. Other symbols get a_
prefix.x
: Windows x86 COFF mangling: Private symbols get the usual prefix. Regular C symbols get a_
prefix. Functions with__stdcall
,__fastcall
, and__vectorcall
have custom mangling that appends@N
where N is the number of bytes used to pass parameters. C++ symbols starting with?
are not mangled in any way.w
: Windows COFF mangling: Similar tox
, except that normal C symbols do not receive a_
prefix.a
: XCOFF mangling: Private symbols get aL..
prefix.
n<size1>:<size2>:<size3>...
This specifies a set of native integer widths for the target CPU in bits. For example, it might contain
n32
for 32-bit PowerPC,n32:64
for PowerPC 64, orn8:16:32:64
for X86-64. Elements of this set are considered to support most general arithmetic operations efficiently.ni:<address space0>:<address space1>:<address space2>...
This specifies pointer types with the specified address spaces as Non-Integral Pointer Type s. The
0
address space cannot be specified as non-integral.
On every specification that takes a <abi>:<pref>
, specifying the
<pref>
alignment is optional. If omitted, the preceding :
should be omitted too and <pref>
will be equal to <abi>
.
When constructing the data layout for a given target, LLVM starts with a
default set of specifications which are then (possibly) overridden by
the specifications in the datalayout
keyword. The default
specifications are given in this list:
e
- little endianp:64:64:64
- 64-bit pointers with 64-bit alignment.p[n]:64:64:64
- Other address spaces are assumed to be the same as the default address space.S0
- natural stack alignment is unspecifiedi1:8:8
- i1 is 8-bit (byte) alignedi8:8:8
- i8 is 8-bit (byte) aligned as mandatedi16:16:16
- i16 is 16-bit alignedi32:32:32
- i32 is 32-bit alignedi64:32:64
- i64 has ABI alignment of 32-bits but preferred alignment of 64-bitsf16:16:16
- half is 16-bit alignedf32:32:32
- float is 32-bit alignedf64:64:64
- double is 64-bit alignedf128:128:128
- quad is 128-bit alignedv64:64:64
- 64-bit vector is 64-bit alignedv128:128:128
- 128-bit vector is 128-bit aligneda:0:64
- aggregates are 64-bit aligned
When LLVM is determining the alignment for a given type, it uses the following rules:
If the type sought is an exact match for one of the specifications, that specification is used.
If no match is found, and the type sought is an integer type, then the smallest integer type that is larger than the bitwidth of the sought type is used. If none of the specifications are larger than the bitwidth then the largest integer type is used. For example, given the default specifications above, the i7 type will use the alignment of i8 (next largest) while both i65 and i256 will use the alignment of i64 (largest specified).
The function of the data layout string may not be what you expect. Notably, this is not a specification from the frontend of what alignment the code generator should use.
Instead, if specified, the target data layout is required to match what the ultimate code generator expects. This string is used by the mid-level optimizers to improve code, and this only works if it matches what the ultimate code generator uses. There is no way to generate IR that does not embed this target-specific detail into the IR. If you don’t specify the string, the default specifications will be used to generate a Data Layout and the optimization phases will operate accordingly and introduce target specificity into the IR with respect to these default specifications.
Target Triple¶
A module may specify a target triple string that describes the target host. The syntax for the target triple is simply:
target triple = "x86_64-apple-macosx10.7.0"
The target triple string consists of a series of identifiers delimited by the minus sign character (‘-‘). The canonical forms are:
ARCHITECTURE-VENDOR-OPERATING_SYSTEM
ARCHITECTURE-VENDOR-OPERATING_SYSTEM-ENVIRONMENT
This information is passed along to the backend so that it generates
code for the proper architecture. It’s possible to override this on the
command line with the -mtriple
command line option.
Object Lifetime¶
A memory object, or simply object, is a region of a memory space that is reserved by a memory allocation such as alloca, heap allocation calls, and global variable definitions. Once it is allocated, the bytes stored in the region can only be read or written through a pointer that is based on the allocation value. If a pointer that is not based on the object tries to read or write to the object, it is undefined behavior.
A lifetime of a memory object is a property that decides its accessibility. Unless stated otherwise, a memory object is alive since its allocation, and dead after its deallocation. It is undefined behavior to access a memory object that isn’t alive, but operations that don’t dereference it such as getelementptr, ptrtoint and icmp return a valid result. This explains code motion of these instructions across operations that impact the object’s lifetime. A stack object’s lifetime can be explicitly specified using llvm.lifetime.start and llvm.lifetime.end intrinsic function calls.
Pointer Aliasing Rules¶
Any memory access must be done through a pointer value associated with an address range of the memory access, otherwise the behavior is undefined. Pointer values are associated with address ranges according to the following rules:
A pointer value is associated with the addresses associated with any value it is based on.
An address of a global variable is associated with the address range of the variable’s storage.
The result value of an allocation instruction is associated with the address range of the allocated storage.
A null pointer in the default address-space is associated with no address.
An undef value in any address-space is associated with no address.
An integer constant other than zero or a pointer value returned from a function not defined within LLVM may be associated with address ranges allocated through mechanisms other than those provided by LLVM. Such ranges shall not overlap with any ranges of addresses allocated by mechanisms provided by LLVM.
A pointer value is based on another pointer value according to the following rules:
A pointer value formed from a scalar
getelementptr
operation is based on the pointer-typed operand of thegetelementptr
.The pointer in lane l of the result of a vector
getelementptr
operation is based on the pointer in lane l of the vector-of-pointers-typed operand of thegetelementptr
.The result value of a
bitcast
is based on the operand of thebitcast
.A pointer value formed by an
inttoptr
is based on all pointer values that contribute (directly or indirectly) to the computation of the pointer’s value.The “based on” relationship is transitive.
Note that this definition of “based” is intentionally similar to the definition of “based” in C99, though it is slightly weaker.
LLVM IR does not associate types with memory. The result type of a
load
merely indicates the size and alignment of the memory from
which to load, as well as the interpretation of the value. The first
operand type of a store
similarly only indicates the size and
alignment of the store.
Consequently, type-based alias analysis, aka TBAA, aka
-fstrict-aliasing
, is not applicable to general unadorned LLVM IR.
Metadata may be used to encode additional information
which specialized optimization passes may use to implement type-based
alias analysis.
Pointer Capture¶
Given a function call and a pointer that is passed as an argument or stored in the memory before the call, a pointer is captured by the call if it makes a copy of any part of the pointer that outlives the call. To be precise, a pointer is captured if one or more of the following conditions hold:
The call stores any bit of the pointer carrying information into a place, and the stored bits can be read from the place by the caller after this call exits.
@glb = global ptr null
@glb2 = global ptr null
@glb3 = global ptr null
@glbi = global i32 0
define ptr @f(ptr %a, ptr %b, ptr %c, ptr %d, ptr %e) {
store ptr %a, ptr @glb ; %a is captured by this call
store ptr %b, ptr @glb2 ; %b isn't captured because the stored value is overwritten by the store below
store ptr null, ptr @glb2
store ptr %c, ptr @glb3
call void @g() ; If @g makes a copy of %c that outlives this call (@f), %c is captured
store ptr null, ptr @glb3
%i = ptrtoint ptr %d to i64
%j = trunc i64 %i to i32
store i32 %j, ptr @glbi ; %d is captured
ret ptr %e ; %e is captured
}
The call stores any bit of the pointer carrying information into a place, and the stored bits can be safely read from the place by another thread via synchronization.
@lock = global i1 true
define void @f(ptr %a) {
store ptr %a, ptr* @glb
store atomic i1 false, ptr @lock release ; %a is captured because another thread can safely read @glb
store ptr null, ptr @glb
ret void
}
The call’s behavior depends on any bit of the pointer carrying information.
@glb = global i8 0
define void @f(ptr %a) {
%c = icmp eq ptr %a, @glb
br i1 %c, label %BB_EXIT, label %BB_CONTINUE ; escapes %a
BB_EXIT:
call void @exit()
unreachable
BB_CONTINUE:
ret void
}
The pointer is used in a volatile access as its address.
Volatile Memory Accesses¶
Certain memory accesses, such as load’s,
store’s, and llvm.memcpy’s may be
marked volatile
. The optimizers must not change the number of
volatile operations or change their order of execution relative to other
volatile operations. The optimizers may change the order of volatile
operations relative to non-volatile operations. This is not Java’s
“volatile” and has no cross-thread synchronization behavior.
A volatile load or store may have additional target-specific semantics. Any volatile operation can have side effects, and any volatile operation can read and/or modify state which is not accessible via a regular load or store in this module. Volatile operations may use addresses which do not point to memory (like MMIO registers). This means the compiler may not use a volatile operation to prove a non-volatile access to that address has defined behavior.
The allowed side-effects for volatile accesses are limited. If a non-volatile store to a given address would be legal, a volatile operation may modify the memory at that address. A volatile operation may not modify any other memory accessible by the module being compiled. A volatile operation may not call any code in the current module.
In general (without target specific context), the address space of a volatile operation may not be changed. Different address spaces may have different trapping behavior when dereferencing an invalid pointer.
The compiler may assume execution will continue after a volatile operation, so operations which modify memory or may have undefined behavior can be hoisted past a volatile operation.
As an exception to the preceding rule, the compiler may not assume execution will continue after a volatile store operation. This restriction is necessary to support the somewhat common pattern in C of intentionally storing to an invalid pointer to crash the program. In the future, it might make sense to allow frontends to control this behavior.
IR-level volatile loads and stores cannot safely be optimized into llvm.memcpy or llvm.memmove intrinsics even when those intrinsics are flagged volatile. Likewise, the backend should never split or merge target-legal volatile load/store instructions. Similarly, IR-level volatile loads and stores cannot change from integer to floating-point or vice versa.
Rationale
Platforms may rely on volatile loads and stores of natively supported data width to be executed as single instruction. For example, in C this holds for an l-value of volatile primitive type with native hardware support, but not necessarily for aggregate types. The frontend upholds these expectations, which are intentionally unspecified in the IR. The rules above ensure that IR transformations do not violate the frontend’s contract with the language.
Memory Model for Concurrent Operations¶
The LLVM IR does not define any way to start parallel threads of execution or to register signal handlers. Nonetheless, there are platform-specific ways to create them, and we define LLVM IR’s behavior in their presence. This model is inspired by the C++0x memory model.
For a more informal introduction to this model, see the LLVM Atomic Instructions and Concurrency Guide.
We define a happens-before partial order as the least partial order that
Is a superset of single-thread program order, and
When a synchronizes-with
b
, includes an edge froma
tob
. Synchronizes-with pairs are introduced by platform-specific techniques, like pthread locks, thread creation, thread joining, etc., and by atomic instructions. (See also Atomic Memory Ordering Constraints).
Note that program order does not introduce happens-before edges between a thread and signals executing inside that thread.
Every (defined) read operation (load instructions, memcpy, atomic loads/read-modify-writes, etc.) R reads a series of bytes written by (defined) write operations (store instructions, atomic stores/read-modify-writes, memcpy, etc.). For the purposes of this section, initialized globals are considered to have a write of the initializer which is atomic and happens before any other read or write of the memory in question. For each byte of a read R, Rbyte may see any write to the same byte, except:
If write1 happens before write2, and write2 happens before Rbyte, then Rbyte does not see write1.
If Rbyte happens before write3, then Rbyte does not see write3.
Given that definition, Rbyte is defined as follows:
If R is volatile, the result is target-dependent. (Volatile is supposed to give guarantees which can support
sig_atomic_t
in C/C++, and may be used for accesses to addresses that do not behave like normal memory. It does not generally provide cross-thread synchronization.)Otherwise, if there is no write to the same byte that happens before Rbyte, Rbyte returns
undef
for that byte.Otherwise, if Rbyte may see exactly one write, Rbyte returns the value written by that write.
Otherwise, if R is atomic, and all the writes Rbyte may see are atomic, it chooses one of the values written. See the Atomic Memory Ordering Constraints section for additional constraints on how the choice is made.
Otherwise Rbyte returns
undef
.
R returns the value composed of the series of bytes it read. This
implies that some bytes within the value may be undef
without
the entire value being undef
. Note that this only defines the
semantics of the operation; it doesn’t mean that targets will emit more
than one instruction to read the series of bytes.
Note that in cases where none of the atomic intrinsics are used, this model places only one restriction on IR transformations on top of what is required for single-threaded execution: introducing a store to a byte which might not otherwise be stored is not allowed in general. (Specifically, in the case where another thread might write to and read from an address, introducing a store can change a load that may see exactly one write into a load that may see multiple writes.)
Atomic Memory Ordering Constraints¶
Atomic instructions (cmpxchg, atomicrmw, fence, atomic load, and atomic store) take ordering parameters that determine which other atomic instructions on the same address they synchronize with. These semantics are borrowed from Java and C++0x, but are somewhat more colloquial. If these descriptions aren’t precise enough, check those specs (see spec references in the atomics guide). fence instructions treat these orderings somewhat differently since they don’t take an address. See that instruction’s documentation for details.
For a simpler introduction to the ordering constraints, see the LLVM Atomic Instructions and Concurrency Guide.
unordered
The set of values that can be read is governed by the happens-before partial order. A value cannot be read unless some operation wrote it. This is intended to provide a guarantee strong enough to model Java’s non-volatile shared variables. This ordering cannot be specified for read-modify-write operations; it is not strong enough to make them atomic in any interesting way.
monotonic
In addition to the guarantees of
unordered
, there is a single total order for modifications bymonotonic
operations on each address. All modification orders must be compatible with the happens-before order. There is no guarantee that the modification orders can be combined to a global total order for the whole program (and this often will not be possible). The read in an atomic read-modify-write operation (cmpxchg and atomicrmw) reads the value in the modification order immediately before the value it writes. If one atomic read happens before another atomic read of the same address, the later read must see the same value or a later value in the address’s modification order. This disallows reordering ofmonotonic
(or stronger) operations on the same address. If an address is writtenmonotonic
-ally by one thread, and other threadsmonotonic
-ally read that address repeatedly, the other threads must eventually see the write. This corresponds to the C++0x/C1xmemory_order_relaxed
.acquire
In addition to the guarantees of
monotonic
, a synchronizes-with edge may be formed with arelease
operation. This is intended to model C++’smemory_order_acquire
.release
In addition to the guarantees of
monotonic
, if this operation writes a value which is subsequently read by anacquire
operation, it synchronizes-with that operation. (This isn’t a complete description; see the C++0x definition of a release sequence.) This corresponds to the C++0x/C1xmemory_order_release
.acq_rel
(acquire+release)Acts as both an
acquire
andrelease
operation on its address. This corresponds to the C++0x/C1xmemory_order_acq_rel
.seq_cst
(sequentially consistent)In addition to the guarantees of
acq_rel
(acquire
for an operation that only reads,release
for an operation that only writes), there is a global total order on all sequentially-consistent operations on all addresses, which is consistent with the happens-before partial order and with the modification orders of all the affected addresses. Each sequentially-consistent read sees the last preceding write to the same address in this global order. This corresponds to the C++0x/C1xmemory_order_seq_cst
and Java volatile.
If an atomic operation is marked syncscope("singlethread")
, it only
synchronizes with and only participates in the seq_cst total orderings of
other operations running in the same thread (for example, in signal handlers).
If an atomic operation is marked syncscope("<target-scope>")
, where
<target-scope>
is a target specific synchronization scope, then it is target
dependent if it synchronizes with and participates in the seq_cst total
orderings of other operations.
Otherwise, an atomic operation that is not marked syncscope("singlethread")
or syncscope("<target-scope>")
synchronizes with and participates in the
seq_cst total orderings of other operations that are not marked
syncscope("singlethread")
or syncscope("<target-scope>")
.
Floating-Point Environment¶
The default LLVM floating-point environment assumes that traps are disabled and status flags are not observable. Therefore, floating-point math operations do not have side effects and may be speculated freely. Results assume the round-to-nearest rounding mode, and subnormals are assumed to be preserved.
Running LLVM code in an environment where these assumptions are not met can lead
to undefined behavior. The strictfp
and denormal-fp-math
attributes as
well as Constrained Floating-Point Intrinsics can be used
to weaken LLVM’s assumptions and ensure defined behavior in non-default
floating-point environments; see their respective documentation for details.
Behavior of Floating-Point NaN values¶
A floating-point NaN value consists of a sign bit, a quiet/signaling bit, and a
payload (which makes up the rest of the mantissa except for the quiet/signaling
bit). LLVM assumes that the quiet/signaling bit being set to 1
indicates a
quiet NaN (QNaN), and a value of 0
indicates a signaling NaN (SNaN). In the
following we will hence just call it the “quiet bit”.
The representation bits of a floating-point value do not mutate arbitrarily; in particular, if there is no floating-point operation being performed, NaN signs, quiet bits, and payloads are preserved.
For the purpose of this section, bitcast
as well as the following operations
are not “floating-point math operations”: fneg
, llvm.fabs
, and
llvm.copysign
. These operations act directly on the underlying bit
representation and never change anything except possibly for the sign bit.
For floating-point math operations, unless specified otherwise, the following rules apply when a NaN value is returned: the result has a non-deterministic sign; the quiet bit and payload are non-deterministically chosen from the following set of options:
The quiet bit is set and the payload is all-zero. (“Preferred NaN” case)
The quiet bit is set and the payload is copied from any input operand that is a NaN. (“Quieting NaN propagation” case)
The quiet bit and payload are copied from any input operand that is a NaN. (“Unchanged NaN propagation” case)
The quiet bit is set and the payload is picked from a target-specific set of “extra” possible NaN payloads. The set can depend on the input operand values. This set is empty on x86 and ARM, but can be non-empty on other architectures. (For instance, on wasm, if any input NaN does not have the preferred all-zero payload or any input NaN is an SNaN, then this set contains all possible payloads; otherwise, it is empty. On SPARC, this set consists of the all-one payload.)
In particular, if all input NaNs are quiet (or if there are no input NaNs), then the output NaN is definitely quiet. Signaling NaN outputs can only occur if they are provided as an input value. For example, “fmul SNaN, 1.0” may be simplified to SNaN rather than QNaN. Similarly, if all input NaNs are preferred (or if there are no input NaNs) and the target does not have any “extra” NaN payloads, then the output NaN is guaranteed to be preferred.
Floating-point math operations are allowed to treat all NaNs as if they were quiet NaNs. For example, “pow(1.0, SNaN)” may be simplified to 1.0.
Code that requires different behavior than this should use the Constrained Floating-Point Intrinsics. In particular, constrained intrinsics rule out the “Unchanged NaN propagation” case; they are guaranteed to return a QNaN.
Unfortunately, due to hard-or-impossible-to-fix issues, LLVM violates its own specification on some architectures:
x86-32 without SSE2 enabled may convert floating-point values to x86_fp80 and back when performing floating-point math operations; this can lead to results with different precision than expected and it can alter NaN values. Since optimizations can make contradicting assumptions, this can lead to arbitrary miscompilations. See issue #44218.
x86-32 (even with SSE2 enabled) may implicitly perform such a conversion on values returned from a function for some calling conventions. See issue #66803.
Older MIPS versions use the opposite polarity for the quiet/signaling bit, and LLVM does not correctly represent this. See issue #60796.
Fast-Math Flags¶
LLVM IR floating-point operations (fneg, fadd, fsub, fmul, fdiv, frem, fcmp), phi, select and call may use the following flags to enable otherwise unsafe floating-point transformations.
nnan
No NaNs - Allow optimizations to assume the arguments and result are not NaN. If an argument is a nan, or the result would be a nan, it produces a poison value instead.
ninf
No Infs - Allow optimizations to assume the arguments and result are not +/-Inf. If an argument is +/-Inf, or the result would be +/-Inf, it produces a poison value instead.
nsz
No Signed Zeros - Allow optimizations to treat the sign of a zero argument or zero result as insignificant. This does not imply that -0.0 is poison and/or guaranteed to not exist in the operation.
arcp
Allow Reciprocal - Allow optimizations to use the reciprocal of an argument rather than perform division.
contract
Allow floating-point contraction (e.g. fusing a multiply followed by an addition into a fused multiply-and-add). This does not enable reassociating to form arbitrary contractions. For example,
(a*b) + (c*d) + e
can not be transformed into(a*b) + ((c*d) + e)
to create two fma operations.
afn
Approximate functions - Allow substitution of approximate calculations for functions (sin, log, sqrt, etc). See floating-point intrinsic definitions for places where this can apply to LLVM’s intrinsic math functions.
reassoc
Allow reassociation transformations for floating-point instructions. This may dramatically change results in floating-point.
fast
This flag implies all of the others.
Use-list Order Directives¶
Use-list directives encode the in-memory order of each use-list, allowing the
order to be recreated. <order-indexes>
is a comma-separated list of
indexes that are assigned to the referenced value’s uses. The referenced
value’s use-list is immediately sorted by these indexes.
Use-list directives may appear at function scope or global scope. They are not instructions, and have no effect on the semantics of the IR. When they’re at function scope, they must appear after the terminator of the final basic block.
If basic blocks have their address taken via blockaddress()
expressions,
uselistorder_bb
can be used to reorder their use-lists from outside their
function’s scope.
- Syntax:
uselistorder <ty> <value>, { <order-indexes> }
uselistorder_bb @function, %block { <order-indexes> }
- Examples:
define void @foo(i32 %arg1, i32 %arg2) {
entry:
; ... instructions ...
bb:
; ... instructions ...
; At function scope.
uselistorder i32 %arg1, { 1, 0, 2 }
uselistorder label %bb, { 1, 0 }
}
; At global scope.
uselistorder ptr @global, { 1, 2, 0 }
uselistorder i32 7, { 1, 0 }
uselistorder i32 (i32) @bar, { 1, 0 }
uselistorder_bb @foo, %bb, { 5, 1, 3, 2, 0, 4 }
Source Filename¶
The source filename string is set to the original module identifier, which will be the name of the compiled source file when compiling from source through the clang front end, for example. It is then preserved through the IR and bitcode.
This is currently necessary to generate a consistent unique global identifier for local functions used in profile data, which prepends the source file name to the local function name.
The syntax for the source file name is simply:
source_filename = "/path/to/source.c"
Type System¶
The LLVM type system is one of the most important features of the intermediate representation. Being typed enables a number of optimizations to be performed on the intermediate representation directly, without having to do extra analyses on the side before the transformation. A strong type system makes it easier to read the generated code and enables novel analyses and transformations that are not feasible to perform on normal three address code representations.
Void Type¶
- Overview:
The void type does not represent any value and has no size.
- Syntax:
void
Function Type¶
- Overview:
The function type can be thought of as a function signature. It consists of a return type and a list of formal parameter types. The return type of a function type is a void type or first class type — except for label and metadata types.
- Syntax:
<returntype> (<parameter list>)
…where ‘<parameter list>
’ is a comma-separated list of type
specifiers. Optionally, the parameter list may include a type ...
, which
indicates that the function takes a variable number of arguments. Variable
argument functions can access their arguments with the variable argument
handling intrinsic functions. ‘<returntype>
’ is any type
except label and metadata.
- Examples:
|
function taking an |
|
A vararg function that takes at least one pointer argument and returns an integer. This is the signature for |
|
A function taking an |
First Class Types¶
The first class types are perhaps the most important. Values of these types are the only ones which can be produced by instructions.
Single Value Types¶
These are the types that are valid in registers from CodeGen’s perspective.
Integer Type¶
- Overview:
The integer type is a very simple type that simply specifies an arbitrary bit width for the integer type desired. Any bit width from 1 bit to 223(about 8 million) can be specified.
- Syntax:
iN
The number of bits the integer will occupy is specified by the N
value.
Examples:¶
|
a single-bit integer. |
|
a 32-bit integer. |
|
a really big integer of over 1 million bits. |
Floating-Point Types¶
Type |
Description |
---|---|
|
16-bit floating-point value |
|
16-bit “brain” floating-point value (7-bit significand). Provides the
same number of exponent bits as |
|
32-bit floating-point value |
|
64-bit floating-point value |
|
128-bit floating-point value (113-bit significand) |
|
80-bit floating-point value (X87) |
|
128-bit floating-point value (two 64-bits) |
The binary format of half, float, double, and fp128 correspond to the IEEE-754-2008 specifications for binary16, binary32, binary64, and binary128 respectively.
X86_amx Type¶
- Overview:
The x86_amx type represents a value held in an AMX tile register on an x86 machine. The operations allowed on it are quite limited. Only few intrinsics are allowed: stride load and store, zero and dot product. No instruction is allowed for this type. There are no arguments, arrays, pointers, vectors or constants of this type.
- Syntax:
x86_amx
X86_mmx Type¶
- Overview:
The x86_mmx type represents a value held in an MMX register on an x86 machine. The operations allowed on it are quite limited: parameters and return values, load and store, and bitcast. User-specified MMX instructions are represented as intrinsic or asm calls with arguments and/or results of this type. There are no arrays, vectors or constants of this type.
- Syntax:
x86_mmx
Pointer Type¶
- Overview:
The pointer type ptr
is used to specify memory locations. Pointers are
commonly used to reference objects in memory.
Pointer types may have an optional address space attribute defining
the numbered address space where the pointed-to object resides. For
example, ptr addrspace(5)
is a pointer to address space 5.
In addition to integer constants, addrspace
can also reference one of the
address spaces defined in the datalayout string.
addrspace("A")
will use the alloca address space, addrspace("G")
the default globals address space and addrspace("P")
the program address
space.
The default address space is number zero.
The semantics of non-zero address spaces are target-specific. Memory
access through a non-dereferenceable pointer is undefined behavior in
any address space. Pointers with the bit-value 0 are only assumed to
be non-dereferenceable in address space 0, unless the function is
marked with the null_pointer_is_valid
attribute.
If an object can be proven accessible through a pointer with a
different address space, the access may be modified to use that
address space. Exceptions apply if the operation is volatile
.
Prior to LLVM 15, pointer types also specified a pointee type, such as
i8*
, [4 x i32]*
or i32 (i32*)*
. In LLVM 15, such “typed
pointers” are still supported under non-default options. See the
opaque pointers document for more information.
Target Extension Type¶
- Overview:
Target extension types represent types that must be preserved through optimization, but are otherwise generally opaque to the compiler. They may be used as function parameters or arguments, and in phi or select instructions. Some types may be also used in alloca instructions or as global values, and correspondingly it is legal to use load and store instructions on them. Full semantics for these types are defined by the target.
The only constants that target extension types may have are zeroinitializer
,
undef
, and poison
. Other possible values for target extension types may
arise from target-specific intrinsics and functions.
These types cannot be converted to other types. As such, it is not legal to use them in bitcast instructions (as a source or target type), nor is it legal to use them in ptrtoint or inttoptr instructions. Similarly, they are not legal to use in an icmp instruction.
Target extension types have a name and optional type or integer parameters. The meanings of name and parameters are defined by the target. When being defined in LLVM IR, all of the type parameters must precede all of the integer parameters.
Specific target extension types are registered with LLVM as having specific
properties. These properties can be used to restrict the type from appearing in
certain contexts, such as being the type of a global variable or having a
zeroinitializer
constant be valid. A complete list of type properties may be
found in the documentation for llvm::TargetExtType::Property
(doxygen).
- Syntax:
target("label")
target("label", void)
target("label", void, i32)
target("label", 0, 1, 2)
target("label", void, i32, 0, 1, 2)
Vector Type¶
- Overview:
A vector type is a simple derived type that represents a vector of elements. Vector types are used when multiple primitive data are operated in parallel using a single instruction (SIMD). A vector type requires a size (number of elements), an underlying primitive data type, and a scalable property to represent vectors where the exact hardware vector length is unknown at compile time. Vector types are considered first class.
- Memory Layout:
In general vector elements are laid out in memory in the same way as array types. Such an analogy works fine as long as the vector elements are byte sized. However, when the elements of the vector aren’t byte sized it gets a bit more complicated. One way to describe the layout is by describing what happens when a vector such as <N x iM> is bitcasted to an integer type with N*M bits, and then following the rules for storing such an integer to memory.
A bitcast from a vector type to a scalar integer type will see the elements being packed together (without padding). The order in which elements are inserted in the integer depends on endianness. For little endian element zero is put in the least significant bits of the integer, and for big endian element zero is put in the most significant bits.
Using a vector such as <i4 1, i4 2, i4 3, i4 5>
as an example, together
with the analogy that we can replace a vector store by a bitcast followed by
an integer store, we get this for big endian:
%val = bitcast <4 x i4> <i4 1, i4 2, i4 3, i4 5> to i16
; Bitcasting from a vector to an integral type can be seen as
; concatenating the values:
; %val now has the hexadecimal value 0x1235.
store i16 %val, ptr %ptr
; In memory the content will be (8-bit addressing):
;
; [%ptr + 0]: 00010010 (0x12)
; [%ptr + 1]: 00110101 (0x35)
The same example for little endian:
%val = bitcast <4 x i4> <i4 1, i4 2, i4 3, i4 5> to i16
; Bitcasting from a vector to an integral type can be seen as
; concatenating the values:
; %val now has the hexadecimal value 0x5321.
store i16 %val, ptr %ptr
; In memory the content will be (8-bit addressing):
;
; [%ptr + 0]: 00100001 (0x21)
; [%ptr + 1]: 01010011 (0x53)
When <N*M>
isn’t evenly divisible by the byte size the exact memory layout
is unspecified (just like it is for an integral type of the same size). This
is because different targets could put the padding at different positions when
the type size is smaller than the type’s store size.
- Syntax:
< <# elements> x <elementtype> > ; Fixed-length vector
< vscale x <# elements> x <elementtype> > ; Scalable vector
The number of elements is a constant integer value larger than 0; elementtype may be any integer, floating-point or pointer type. Vectors of size zero are not allowed. For scalable vectors, the total number of elements is a constant multiple (called vscale) of the specified number of elements; vscale is a positive integer that is unknown at compile time and the same hardware-dependent constant for all scalable vectors at run time. The size of a specific scalable vector type is thus constant within IR, even if the exact size in bytes cannot be determined until run time.
- Examples:
|
Vector of 4 32-bit integer values. |
|
Vector of 8 32-bit floating-point values. |
|
Vector of 2 64-bit integer values. |
|
Vector of 4 pointers |
|
Vector with a multiple of 4 32-bit integer values. |
Label Type¶
- Overview:
The label type represents code labels.
- Syntax:
label
Token Type¶
- Overview:
The token type is used when a value is associated with an instruction but all uses of the value must not attempt to introspect or obscure it. As such, it is not appropriate to have a phi or select of type token.
- Syntax:
token
Metadata Type¶
- Overview:
The metadata type represents embedded metadata. No derived types may be created from metadata except for function arguments.
- Syntax:
metadata
Aggregate Types¶
Aggregate Types are a subset of derived types that can contain multiple member types. Arrays and structs are aggregate types. Vectors are not considered to be aggregate types.
Array Type¶
- Overview:
The array type is a very simple derived type that arranges elements sequentially in memory. The array type requires a size (number of elements) and an underlying data type.
- Syntax:
[<# elements> x <elementtype>]
The number of elements is a constant integer value; elementtype
may
be any type with a size.
- Examples:
|
Array of 40 32-bit integer values. |
|
Array of 41 32-bit integer values. |
|
Array of 4 8-bit integer values. |
Here are some examples of multidimensional arrays:
|
3x4 array of 32-bit integer values. |
|
12x10 array of single precision floating-point values. |
|
2x3x4 array of 16-bit integer values. |
There is no restriction on indexing beyond the end of the array implied
by a static type (though there are restrictions on indexing beyond the
bounds of an allocated object in some cases). This means that
single-dimension ‘variable sized array’ addressing can be implemented in
LLVM with a zero length array type. An implementation of ‘pascal style
arrays’ in LLVM could use the type “{ i32, [0 x float]}
”, for
example.
Structure Type¶
- Overview:
The structure type is used to represent a collection of data members together in memory. The elements of a structure may be any type that has a size.
Structures in memory are accessed using ‘load
’ and ‘store
’ by
getting a pointer to a field with the ‘getelementptr
’ instruction.
Structures in registers are accessed using the ‘extractvalue
’ and
‘insertvalue
’ instructions.
Structures may optionally be “packed” structures, which indicate that the alignment of the struct is one byte, and that there is no padding between the elements. In non-packed structs, padding between field types is inserted as defined by the DataLayout string in the module, which is required to match what the underlying code generator expects.
Structures can either be “literal” or “identified”. A literal structure
is defined inline with other types (e.g. [2 x {i32, i32}]
) whereas
identified types are always defined at the top level with a name.
Literal types are uniqued by their contents and can never be recursive
or opaque since there is no way to write one. Identified types can be
recursive, can be opaqued, and are never uniqued.
- Syntax:
%T1 = type { <type list> } ; Identified normal struct type
%T2 = type <{ <type list> }> ; Identified packed struct type
- Examples:
|
A triple of three |
|
A pair, where the first element is a |
|
A packed struct known to be 5 bytes in size. |
Opaque Structure Types¶
- Overview:
Opaque structure types are used to represent structure types that
do not have a body specified. This corresponds (for example) to the C
notion of a forward declared structure. They can be named (%X
) or
unnamed (%52
).
- Syntax:
%X = type opaque
%52 = type opaque
- Examples:
|
An opaque type. |
Constants¶
LLVM has several different basic types of constants. This section describes them all and their syntax.
Simple Constants¶
- Boolean constants
The two strings ‘
true
’ and ‘false
’ are both valid constants of thei1
type.- Integer constants
Standard integers (such as ‘4’) are constants of the integer type. They can be either decimal or hexadecimal. Decimal integers can be prefixed with - to represent negative integers, e.g. ‘
-1234
’. Hexadecimal integers must be prefixed with either u or s to indicate whether they are unsigned or signed respectively. e.g ‘u0x8000
’ gives 32768, whilst ‘s0x8000
’ gives -32768.Note that hexadecimal integers are sign extended from the number of active bits, i.e. the bit width minus the number of leading zeros. So ‘
s0x0001
’ of type ‘i16
’ will be -1, not 1.- Floating-point constants
Floating-point constants use standard decimal notation (e.g. 123.421), exponential notation (e.g. 1.23421e+2), or a more precise hexadecimal notation (see below). The assembler requires the exact decimal value of a floating-point constant. For example, the assembler accepts 1.25 but rejects 1.3 because 1.3 is a repeating decimal in binary. Floating-point constants must have a floating-point type.
- Null pointer constants
The identifier ‘
null
’ is recognized as a null pointer constant and must be of pointer type.- Token constants
The identifier ‘
none
’ is recognized as an empty token constant and must be of token type.
The one non-intuitive notation for constants is the hexadecimal form of
floating-point constants. For example, the form
‘double 0x432ff973cafa8000
’ is equivalent to (but harder to read
than) ‘double 4.5e+15
’. The only time hexadecimal floating-point
constants are required (and the only time that they are generated by the
disassembler) is when a floating-point constant must be emitted but it
cannot be represented as a decimal floating-point number in a reasonable
number of digits. For example, NaN’s, infinities, and other special
values are represented in their IEEE hexadecimal format so that assembly
and disassembly do not cause any bits to change in the constants.
When using the hexadecimal form, constants of types bfloat, half, float, and
double are represented using the 16-digit form shown above (which matches the
IEEE754 representation for double); bfloat, half and float values must, however,
be exactly representable as bfloat, IEEE 754 half, and IEEE 754 single
precision respectively. Hexadecimal format is always used for long double, and
there are three forms of long double. The 80-bit format used by x86 is
represented as 0xK
followed by 20 hexadecimal digits. The 128-bit format
used by PowerPC (two adjacent doubles) is represented by 0xM
followed by 32
hexadecimal digits. The IEEE 128-bit format is represented by 0xL
followed
by 32 hexadecimal digits. Long doubles will only work if they match the long
double format on your target. The IEEE 16-bit format (half precision) is
represented by 0xH
followed by 4 hexadecimal digits. The bfloat 16-bit
format is represented by 0xR
followed by 4 hexadecimal digits. All
hexadecimal formats are big-endian (sign bit at the left).
There are no constants of type x86_mmx and x86_amx.
Complex Constants¶
Complex constants are a (potentially recursive) combination of simple constants and smaller complex constants.
- Structure constants
Structure constants are represented with notation similar to structure type definitions (a comma separated list of elements, surrounded by braces (
{}
)). For example: “{ i32 4, float 17.0, ptr @G }
”, where “@G
” is declared as “@G = external global i32
”. Structure constants must have structure type, and the number and types of elements must match those specified by the type.- Array constants
Array constants are represented with notation similar to array type definitions (a comma separated list of elements, surrounded by square brackets (
[]
)). For example: “[ i32 42, i32 11, i32 74 ]
”. Array constants must have array type, and the number and types of elements must match those specified by the type. As a special case, character array constants may also be represented as a double-quoted string using thec
prefix. For example: “c"Hello World\0A\00"
”.- Vector constants
Vector constants are represented with notation similar to vector type definitions (a comma separated list of elements, surrounded by less-than/greater-than’s (
<>
)). For example: “< i32 42, i32 11, i32 74, i32 100 >
”. Vector constants must have vector type, and the number and types of elements must match those specified by the type.When creating a vector whose elements have the same constant value, the preferred syntax is
splat (<Ty> Val)
. For example: “splat (i32 11)
”. These vector constants must have :vector type with an element type that matches thesplat
operand.- Zero initialization
The string ‘
zeroinitializer
’ can be used to zero initialize a value to zero of any type, including scalar and aggregate types. This is often used to avoid having to print large zero initializers (e.g. for large arrays) and is always exactly equivalent to using explicit zero initializers.- Metadata node
A metadata node is a constant tuple without types. For example: “
!{!0, !{!2, !0}, !"test"}
”. Metadata can reference constant values, for example: “!{!0, i32 0, ptr @global, ptr @function, !"str"}
”. Unlike other typed constants that are meant to be interpreted as part of the instruction stream, metadata is a place to attach additional information such as debug info.
Global Variable and Function Addresses¶
The addresses of global variables and functions are always implicitly valid (link-time) constants. These constants are explicitly referenced when the identifier for the global is used and always have pointer type. For example, the following is a legal LLVM file:
@X = global i32 17
@Y = global i32 42
@Z = global [2 x ptr] [ ptr @X, ptr @Y ]
Undefined Values¶
The string ‘undef
’ can be used anywhere a constant is expected, and
indicates that the user of the value may receive an unspecified
bit-pattern. Undefined values may be of any type (other than ‘label
’
or ‘void
’) and be used anywhere a constant is permitted.
Note
A ‘poison
’ value (described in the next section) should be used instead of
‘undef
’ whenever possible. Poison values are stronger than undef, and
enable more optimizations. Just the existence of ‘undef
’ blocks certain
optimizations (see the examples below).
Undefined values are useful because they indicate to the compiler that the program is well defined no matter what value is used. This gives the compiler more freedom to optimize. Here are some examples of (potentially surprising) transformations that are valid (in pseudo IR):
%A = add %X, undef
%B = sub %X, undef
%C = xor %X, undef
Safe:
%A = undef
%B = undef
%C = undef
This is safe because all of the output bits are affected by the undef bits. Any output bit can have a zero or one depending on the input bits.
%A = or %X, undef
%B = and %X, undef
Safe:
%A = -1
%B = 0
Safe:
%A = %X ;; By choosing undef as 0
%B = %X ;; By choosing undef as -1
Unsafe:
%A = undef
%B = undef
These logical operations have bits that are not always affected by the
input. For example, if %X
has a zero bit, then the output of the
‘and
’ operation will always be a zero for that bit, no matter what
the corresponding bit from the ‘undef
’ is. As such, it is unsafe to
optimize or assume that the result of the ‘and
’ is ‘undef
’.
However, it is safe to assume that all bits of the ‘undef
’ could be
0, and optimize the ‘and
’ to 0. Likewise, it is safe to assume that
all the bits of the ‘undef
’ operand to the ‘or
’ could be set,
allowing the ‘or
’ to be folded to -1.
%A = select undef, %X, %Y
%B = select undef, 42, %Y
%C = select %X, %Y, undef
Safe:
%A = %X (or %Y)
%B = 42 (or %Y)
%C = %Y (if %Y is provably not poison; unsafe otherwise)
Unsafe:
%A = undef
%B = undef
%C = undef
This set of examples shows that undefined ‘select
’ (and conditional
branch) conditions can go either way, but they have to come from one
of the two operands. In the %A
example, if %X
and %Y
were
both known to have a clear low bit, then %A
would have to have a
cleared low bit. However, in the %C
example, the optimizer is
allowed to assume that the ‘undef
’ operand could be the same as
%Y
if %Y
is provably not ‘poison
’, allowing the whole ‘select
’
to be eliminated. This is because ‘poison
’ is stronger than ‘undef
’.
%A = xor undef, undef
%B = undef
%C = xor %B, %B
%D = undef
%E = icmp slt %D, 4
%F = icmp gte %D, 4
Safe:
%A = undef
%B = undef
%C = undef
%D = undef
%E = undef
%F = undef
This example points out that two ‘undef
’ operands are not
necessarily the same. This can be surprising to people (and also matches
C semantics) where they assume that “X^X
” is always zero, even if
X
is undefined. This isn’t true for a number of reasons, but the
short answer is that an ‘undef
’ “variable” can arbitrarily change
its value over its “live range”. This is true because the variable
doesn’t actually have a live range. Instead, the value is logically
read from arbitrary registers that happen to be around when needed, so
the value is not necessarily consistent over time. In fact, %A
and
%C
need to have the same semantics or the core LLVM “replace all
uses with” concept would not hold.
To ensure all uses of a given register observe the same value (even if
‘undef
’), the freeze instruction can be used.
%A = sdiv undef, %X
%B = sdiv %X, undef
Safe:
%A = 0
b: unreachable
These examples show the crucial difference between an undefined value
and undefined behavior. An undefined value (like ‘undef
’) is
allowed to have an arbitrary bit-pattern. This means that the %A
operation can be constant folded to ‘0
’, because the ‘undef
’
could be zero, and zero divided by any value is zero.
However, in the second example, we can make a more aggressive
assumption: because the undef
is allowed to be an arbitrary value,
we are allowed to assume that it could be zero. Since a divide by zero
has undefined behavior, we are allowed to assume that the operation
does not execute at all. This allows us to delete the divide and all
code after it. Because the undefined operation “can’t happen”, the
optimizer can assume that it occurs in dead code.
a: store undef -> %X
b: store %X -> undef
Safe:
a: <deleted> (if the stored value in %X is provably not poison)
b: unreachable
A store of an undefined value can be assumed to not have any effect;
we can assume that the value is overwritten with bits that happen to
match what was already there. This argument is only valid if the stored value
is provably not poison
. However, a store to an undefined
location could clobber arbitrary memory, therefore, it has undefined
behavior.
Branching on an undefined value is undefined behavior. This explains optimizations that depend on branch conditions to construct predicates, such as Correlated Value Propagation and Global Value Numbering. In case of switch instruction, the branch condition should be frozen, otherwise it is undefined behavior.
Unsafe:
br undef, BB1, BB2 ; UB
%X = and i32 undef, 255
switch %X, label %ret [ .. ] ; UB
store undef, ptr %ptr
%X = load ptr %ptr ; %X is undef
switch i8 %X, label %ret [ .. ] ; UB
Safe:
%X = or i8 undef, 255 ; always 255
switch i8 %X, label %ret [ .. ] ; Well-defined
%X = freeze i1 undef
br %X, BB1, BB2 ; Well-defined (non-deterministic jump)
Poison Values¶
A poison value is a result of an erroneous operation.
In order to facilitate speculative execution, many instructions do not
invoke immediate undefined behavior when provided with illegal operands,
and return a poison value instead.
The string ‘poison
’ can be used anywhere a constant is expected, and
operations such as add with the nsw
flag can produce
a poison value.
Most instructions return ‘poison
’ when one of their arguments is
‘poison
’. A notable exception is the select instruction.
Propagation of poison can be stopped with the
freeze instruction.
It is correct to replace a poison value with an undef value or any value of the type.
This means that immediate undefined behavior occurs if a poison value is used as an instruction operand that has any values that trigger undefined behavior. Notably this includes (but is not limited to):
The pointer operand of a load, store or any other pointer dereferencing instruction (independent of address space).
The divisor operand of a
udiv
,sdiv
,urem
orsrem
instruction.The condition operand of a br instruction.
The parameter operand of a call or invoke instruction, when the function or invoking call site has a
noundef
attribute in the corresponding position.The operand of a ret instruction if the function or invoking call site has a noundef attribute in the return value position.
Here are some examples:
entry:
%poison = sub nuw i32 0, 1 ; Results in a poison value.
%poison2 = sub i32 poison, 1 ; Also results in a poison value.
%still_poison = and i32 %poison, 0 ; 0, but also poison.
%poison_yet_again = getelementptr i32, ptr @h, i32 %still_poison
store i32 0, ptr %poison_yet_again ; Undefined behavior due to
; store to poison.
store i32 %poison, ptr @g ; Poison value stored to memory.
%poison3 = load i32, ptr @g ; Poison value loaded back from memory.
%poison4 = load i16, ptr @g ; Returns a poison value.
%poison5 = load i64, ptr @g ; Returns a poison value.
%cmp = icmp slt i32 %poison, 0 ; Returns a poison value.
br i1 %cmp, label %end, label %end ; undefined behavior
end:
Well-Defined Values¶
Given a program execution, a value is well defined if the value does not have an undef bit and is not poison in the execution. An aggregate value or vector is well defined if its elements are well defined. The padding of an aggregate isn’t considered, since it isn’t visible without storing it into memory and loading it with a different type.
A constant of a single value, non-vector type is well
defined if it is neither ‘undef
’ constant nor ‘poison
’ constant.
The result of freeze instruction is well defined regardless
of its operand.
Addresses of Basic Blocks¶
blockaddress(@function, %block)
The ‘blockaddress
’ constant computes the address of the specified
basic block in the specified function.
It always has an ptr addrspace(P)
type, where P
is the address space
of the function containing %block
(usually addrspace(0)
).
Taking the address of the entry block is illegal.
This value only has defined behavior when used as an operand to the
‘indirectbr’ or for comparisons against null. Pointer
equality tests between labels addresses results in undefined behavior —
though, again, comparison against null is ok, and no label is equal to the null
pointer. This may be passed around as an opaque pointer sized value as long as
the bits are not inspected. This allows ptrtoint
and arithmetic to be
performed on these values so long as the original value is reconstituted before
the indirectbr
instruction.
Finally, some targets may provide defined semantics when using the value as the operand to an inline assembly, but that is target specific.
DSO Local Equivalent¶
dso_local_equivalent @func
A ‘dso_local_equivalent
’ constant represents a function which is
functionally equivalent to a given function, but is always defined in the
current linkage unit. The resulting pointer has the same type as the underlying
function. The resulting pointer is permitted, but not required, to be different
from a pointer to the function, and it may have different values in different
translation units.
The target function may not have extern_weak
linkage.
dso_local_equivalent
can be implemented as such:
If the function has local linkage, hidden visibility, or is
dso_local
,dso_local_equivalent
can be implemented as simply a pointer to the function.dso_local_equivalent
can be implemented with a stub that tail-calls the function. Many targets support relocations that resolve at link time to either a function or a stub for it, depending on if the function is defined within the linkage unit; LLVM will use this when available. (This is commonly called a “PLT stub”.) On other targets, the stub may need to be emitted explicitly.
This can be used wherever a dso_local
instance of a function is needed without
needing to explicitly make the original function dso_local
. An instance where
this can be used is for static offset calculations between a function and some other
dso_local
symbol. This is especially useful for the Relative VTables C++ ABI,
where dynamic relocations for function pointers in VTables can be replaced with
static relocations for offsets between the VTable and virtual functions which
may not be dso_local
.
This is currently only supported for ELF binary formats.
No CFI¶
no_cfi @func
With Control-Flow Integrity (CFI), a ‘no_cfi
’
constant represents a function reference that does not get replaced with a
reference to the CFI jump table in the LowerTypeTests
pass. These constants
may be useful in low-level programs, such as operating system kernels, which
need to refer to the actual function body.
Constant Expressions¶
Constant expressions are used to allow expressions involving other constants to be used as constants. Constant expressions may be of any first class type and may involve any LLVM operation that does not have side effects (e.g. load and call are not supported). The following is the syntax for constant expressions:
trunc (CST to TYPE)
Perform the trunc operation on constants.
ptrtoint (CST to TYPE)
Perform the ptrtoint operation on constants.
inttoptr (CST to TYPE)
Perform the inttoptr operation on constants. This one is really dangerous!
bitcast (CST to TYPE)
Convert a constant, CST, to another TYPE. The constraints of the operands are the same as those for the bitcast instruction.
addrspacecast (CST to TYPE)
Convert a constant pointer or constant vector of pointer, CST, to another TYPE in a different address space. The constraints of the operands are the same as those for the addrspacecast instruction.
getelementptr (TY, CSTPTR, IDX0, IDX1, ...)
,getelementptr inbounds (TY, CSTPTR, IDX0, IDX1, ...)
Perform the getelementptr operation on constants. As with the getelementptr instruction, the index list may have one or more indexes, which are required to make sense for the type of “pointer to TY”. These indexes may be implicitly sign-extended or truncated to match the index size of CSTPTR’s address space.
icmp COND (VAL1, VAL2)
Perform the icmp operation on constants.
fcmp COND (VAL1, VAL2)
Perform the fcmp operation on constants.
extractelement (VAL, IDX)
Perform the extractelement operation on constants.
insertelement (VAL, ELT, IDX)
Perform the insertelement operation on constants.
shufflevector (VEC1, VEC2, IDXMASK)
Perform the shufflevector operation on constants.
add (LHS, RHS)
Perform an addition on constants.
sub (LHS, RHS)
Perform a subtraction on constants.
mul (LHS, RHS)
Perform a multiplication on constants.
shl (LHS, RHS)
Perform a left shift on constants.
xor (LHS, RHS)
Perform a bitwise xor on constants.
Other Values¶
Inline Assembler Expressions¶
LLVM supports inline assembler expressions (as opposed to Module-Level Inline Assembly) through the use of a special value. This value represents the inline assembler as a template string (containing the instructions to emit), a list of operand constraints (stored as a string), a flag that indicates whether or not the inline asm expression has side effects, and a flag indicating whether the function containing the asm needs to align its stack conservatively.
The template string supports argument substitution of the operands using “$
”
followed by a number, to indicate substitution of the given register/memory
location, as specified by the constraint string. “${NUM:MODIFIER}
” may also
be used, where MODIFIER
is a target-specific annotation for how to print the
operand (See Asm template argument modifiers).
A literal “$
” may be included by using “$$
” in the template. To include
other special characters into the output, the usual “\XX
” escapes may be
used, just as in other strings. Note that after template substitution, the
resulting assembly string is parsed by LLVM’s integrated assembler unless it is
disabled – even when emitting a .s
file – and thus must contain assembly
syntax known to LLVM.
LLVM also supports a few more substitutions useful for writing inline assembly:
${:uid}
: Expands to a decimal integer unique to this inline assembly blob. This substitution is useful when declaring a local label. Many standard compiler optimizations, such as inlining, may duplicate an inline asm blob. Adding a blob-unique identifier ensures that the two labels will not conflict during assembly. This is used to implement GCC’s %= special format string.${:comment}
: Expands to the comment character of the current target’s assembly dialect. This is usually#
, but many targets use other strings, such as;
,//
, or!
.${:private}
: Expands to the assembler private label prefix. Labels with this prefix will not appear in the symbol table of the assembled object. Typically the prefix isL
, but targets may use other strings..L
is relatively popular.
LLVM’s support for inline asm is modeled closely on the requirements of Clang’s GCC-compatible inline-asm support. Thus, the feature-set and the constraint and modifier codes listed here are similar or identical to those in GCC’s inline asm support. However, to be clear, the syntax of the template and constraint strings described here is not the same as the syntax accepted by GCC and Clang, and, while most constraint letters are passed through as-is by Clang, some get translated to other codes when converting from the C source to the LLVM assembly.
An example inline assembler expression is:
i32 (i32) asm "bswap $0", "=r,r"
Inline assembler expressions may only be used as the callee operand of a call or an invoke instruction. Thus, typically we have:
%X = call i32 asm "bswap $0", "=r,r"(i32 %Y)
Inline asms with side effects not visible in the constraint list must be
marked as having side effects. This is done through the use of the
‘sideeffect
’ keyword, like so:
call void asm sideeffect "eieio", ""()
In some cases inline asms will contain code that will not work unless
the stack is aligned in some way, such as calls or SSE instructions on
x86, yet will not contain code that does that alignment within the asm.
The compiler should make conservative assumptions about what the asm
might contain and should generate its usual stack alignment code in the
prologue if the ‘alignstack
’ keyword is present:
call void asm alignstack "eieio", ""()
Inline asms also support using non-standard assembly dialects. The
assumed dialect is ATT. When the ‘inteldialect
’ keyword is present,
the inline asm is using the Intel dialect. Currently, ATT and Intel are
the only supported dialects. An example is:
call void asm inteldialect "eieio", ""()
In the case that the inline asm might unwind the stack,
the ‘unwind
’ keyword must be used, so that the compiler emits
unwinding information:
call void asm unwind "call func", ""()
If the inline asm unwinds the stack and isn’t marked with
the ‘unwind
’ keyword, the behavior is undefined.
If multiple keywords appear, the ‘sideeffect
’ keyword must come
first, the ‘alignstack
’ keyword second, the ‘inteldialect
’ keyword
third and the ‘unwind
’ keyword last.
Inline Asm Constraint String¶
The constraint list is a comma-separated string, each element containing one or more constraint codes.
For each element in the constraint list an appropriate register or memory
operand will be chosen, and it will be made available to assembly template
string expansion as $0
for the first constraint in the list, $1
for the
second, etc.
There are three different types of constraints, which are distinguished by a prefix symbol in front of the constraint code: Output, Input, and Clobber. The constraints must always be given in that order: outputs first, then inputs, then clobbers. They cannot be intermingled.
There are also three different categories of constraint codes:
Register constraint. This is either a register class, or a fixed physical register. This kind of constraint will allocate a register, and if necessary, bitcast the argument or result to the appropriate type.
Memory constraint. This kind of constraint is for use with an instruction taking a memory operand. Different constraints allow for different addressing modes used by the target.
Immediate value constraint. This kind of constraint is for an integer or other immediate value which can be rendered directly into an instruction. The various target-specific constraints allow the selection of a value in the proper range for the instruction you wish to use it with.
Output constraints¶
Output constraints are specified by an “=
” prefix (e.g. “=r
”). This
indicates that the assembly will write to this operand, and the operand will
then be made available as a return value of the asm
expression. Output
constraints do not consume an argument from the call instruction. (Except, see
below about indirect outputs).
Normally, it is expected that no output locations are written to by the assembly
expression until all of the inputs have been read. As such, LLVM may assign
the same register to an output and an input. If this is not safe (e.g. if the
assembly contains two instructions, where the first writes to one output, and
the second reads an input and writes to a second output), then the “&
”
modifier must be used (e.g. “=&r
”) to specify that the output is an
“early-clobber” output. Marking an output as “early-clobber” ensures that LLVM
will not use the same register for any inputs (other than an input tied to this
output).
Input constraints¶
Input constraints do not have a prefix – just the constraint codes. Each input constraint will consume one argument from the call instruction. It is not permitted for the asm to write to any input register or memory location (unless that input is tied to an output). Note also that multiple inputs may all be assigned to the same register, if LLVM can determine that they necessarily all contain the same value.
Instead of providing a Constraint Code, input constraints may also “tie”
themselves to an output constraint, by providing an integer as the constraint
string. Tied inputs still consume an argument from the call instruction, and
take up a position in the asm template numbering as is usual – they will simply
be constrained to always use the same register as the output they’ve been tied
to. For example, a constraint string of “=r,0
” says to assign a register for
output, and use that register as an input as well (it being the 0’th
constraint).
It is permitted to tie an input to an “early-clobber” output. In that case, no other input may share the same register as the input tied to the early-clobber (even when the other input has the same value).
You may only tie an input to an output which has a register constraint, not a memory constraint. Only a single input may be tied to an output.
There is also an “interesting” feature which deserves a bit of explanation: if a register class constraint allocates a register which is too small for the value type operand provided as input, the input value will be split into multiple registers, and all of them passed to the inline asm.
However, this feature is often not as useful as you might think.
Firstly, the registers are not guaranteed to be consecutive. So, on those architectures that have instructions which operate on multiple consecutive instructions, this is not an appropriate way to support them. (e.g. the 32-bit SparcV8 has a 64-bit load, which instruction takes a single 32-bit register. The hardware then loads into both the named register, and the next register. This feature of inline asm would not be useful to support that.)
A few of the targets provide a template string modifier allowing explicit access
to the second register of a two-register operand (e.g. MIPS L
, M
, and
D
). On such an architecture, you can actually access the second allocated
register (yet, still, not any subsequent ones). But, in that case, you’re still
probably better off simply splitting the value into two separate operands, for
clarity. (e.g. see the description of the A
constraint on X86, which,
despite existing only for use with this feature, is not really a good idea to
use)
Indirect inputs and outputs¶
Indirect output or input constraints can be specified by the “*
” modifier
(which goes after the “=
” in case of an output). This indicates that the asm
will write to or read from the contents of an address provided as an input
argument. (Note that in this way, indirect outputs act more like an input than
an output: just like an input, they consume an argument of the call expression,
rather than producing a return value. An indirect output constraint is an
“output” only in that the asm is expected to write to the contents of the input
memory location, instead of just read from it).
This is most typically used for memory constraint, e.g. “=*m
”, to pass the
address of a variable as a value.
It is also possible to use an indirect register constraint, but only on output
(e.g. “=*r
”). This will cause LLVM to allocate a register for an output
value normally, and then, separately emit a store to the address provided as
input, after the provided inline asm. (It’s not clear what value this
functionality provides, compared to writing the store explicitly after the asm
statement, and it can only produce worse code, since it bypasses many
optimization passes. I would recommend not using it.)
Call arguments for indirect constraints must have pointer type and must specify the elementtype attribute to indicate the pointer element type.
Clobber constraints¶
A clobber constraint is indicated by a “~
” prefix. A clobber does not
consume an input operand, nor generate an output. Clobbers cannot use any of the
general constraint code letters – they may use only explicit register
constraints, e.g. “~{eax}
”. The one exception is that a clobber string of
“~{memory}
” indicates that the assembly writes to arbitrary undeclared
memory locations – not only the memory pointed to by a declared indirect
output.
Note that clobbering named registers that are also present in output constraints is not legal.
Label constraints¶
A label constraint is indicated by a “!
” prefix and typically used in the
form "!i"
. Instead of consuming call arguments, label constraints consume
indirect destination labels of callbr
instructions.
Label constraints can only be used in conjunction with callbr
and the
number of label constraints must match the number of indirect destination
labels in the callbr
instruction.
Constraint Codes¶
After a potential prefix comes constraint code, or codes.
A Constraint Code is either a single letter (e.g. “r
”), a “^
” character
followed by two letters (e.g. “^wc
”), or “{
” register-name “}
”
(e.g. “{eax}
”).
The one and two letter constraint codes are typically chosen to be the same as GCC’s constraint codes.
A single constraint may include one or more than constraint code in it, leaving it up to LLVM to choose which one to use. This is included mainly for compatibility with the translation of GCC inline asm coming from clang.
There are two ways to specify alternatives, and either or both may be used in an inline asm constraint list:
Append the codes to each other, making a constraint code set. E.g. “
im
” or “{eax}m
”. This means “choose any of the options in the set”. The choice of constraint is made independently for each constraint in the constraint list.Use “
|
” between constraint code sets, creating alternatives. Every constraint in the constraint list must have the same number of alternative sets. With this syntax, the same alternative in all of the items in the constraint list will be chosen together.
Putting those together, you might have a two operand constraint string like
"rm|r,ri|rm"
. This indicates that if operand 0 is r
or m
, then
operand 1 may be one of r
or i
. If operand 0 is r
, then operand 1
may be one of r
or m
. But, operand 0 and 1 cannot both be of type m.
However, the use of either of the alternatives features is NOT recommended, as
LLVM is not able to make an intelligent choice about which one to use. (At the
point it currently needs to choose, not enough information is available to do so
in a smart way.) Thus, it simply tries to make a choice that’s most likely to
compile, not one that will be optimal performance. (e.g., given “rm
”, it’ll
always choose to use memory, not registers). And, if given multiple registers,
or multiple register classes, it will simply choose the first one. (In fact, it
doesn’t currently even ensure explicitly specified physical registers are
unique, so specifying multiple physical registers as alternatives, like
{r11}{r12},{r11}{r12}
, will assign r11 to both operands, not at all what was
intended.)
Supported Constraint Code List¶
The constraint codes are, in general, expected to behave the same way they do in GCC. LLVM’s support is often implemented on an ‘as-needed’ basis, to support C inline asm code which was supported by GCC. A mismatch in behavior between LLVM and GCC likely indicates a bug in LLVM.
Some constraint codes are typically supported by all targets:
r
: A register in the target’s general purpose register class.m
: A memory address operand. It is target-specific what addressing modes are supported, typical examples are register, or register + register offset, or register + immediate offset (of some target-specific size).p
: An address operand. Similar tom
, but used by “load address” type instructions without touching memory.i
: An integer constant (of target-specific width). Allows either a simple immediate, or a relocatable value.n
: An integer constant – not including relocatable values.s
: An integer constant, but allowing only relocatable values.X
: Allows an operand of any kind, no constraint whatsoever. Typically useful to pass a label for an asm branch or call.{register-name}
: Requires exactly the named physical register.
Other constraints are target-specific:
AArch64:
z
: An immediate integer 0. OutputsWZR
orXZR
, as appropriate.I
: An immediate integer valid for anADD
orSUB
instruction, i.e. 0 to 4095 with optional shift by 12.J
: An immediate integer that, when negated, is valid for anADD
orSUB
instruction, i.e. -1 to -4095 with optional left shift by 12.K
: An immediate integer that is valid for the ‘bitmask immediate 32’ of a logical instruction likeAND
,EOR
, orORR
with a 32-bit register.L
: An immediate integer that is valid for the ‘bitmask immediate 64’ of a logical instruction likeAND
,EOR
, orORR
with a 64-bit register.M
: An immediate integer for use with theMOV
assembly alias on a 32-bit register. This is a superset ofK
: in addition to the bitmask immediate, also allows immediate integers which can be loaded with a singleMOVZ
orMOVL
instruction.N
: An immediate integer for use with theMOV
assembly alias on a 64-bit register. This is a superset ofL
.Q
: Memory address operand must be in a single register (no offsets). (However, LLVM currently does this for them
constraint as well.)r
: A 32 or 64-bit integer register (W* or X*).Uci
: Like r, but restricted to registers 8 to 11 inclusive.Ucj
: Like r, but restricted to registers 12 to 15 inclusive.w
: A 32, 64, or 128-bit floating-point, SIMD or SVE vector register.x
: Like w, but restricted to registers 0 to 15 inclusive.y
: Like w, but restricted to SVE vector registers Z0 to Z7 inclusive.Uph
: One of the upper eight SVE predicate registers (P8 to P15)Upl
: One of the lower eight SVE predicate registers (P0 to P7)Upa
: Any of the SVE predicate registers (P0 to P15)
AMDGPU:
r
: A 32 or 64-bit integer register.[0-9]v
: The 32-bit VGPR register, number 0-9.[0-9]s
: The 32-bit SGPR register, number 0-9.[0-9]a
: The 32-bit AGPR register, number 0-9.I
: An integer inline constant in the range from -16 to 64.J
: A 16-bit signed integer constant.A
: An integer or a floating-point inline constant.B
: A 32-bit signed integer constant.C
: A 32-bit unsigned integer constant or an integer inline constant in the range from -16 to 64.DA
: A 64-bit constant that can be split into two “A” constants.DB
: A 64-bit constant that can be split into two “B” constants.
All ARM modes:
Q
,Um
,Un
,Uq
,Us
,Ut
,Uv
,Uy
: Memory address operand. Treated the same as operandm
, at the moment.Te
: An even general-purpose 32-bit integer register:r0,r2,...,r12,r14
To
: An odd general-purpose 32-bit integer register:r1,r3,...,r11
ARM and ARM’s Thumb2 mode:
j
: An immediate integer between 0 and 65535 (valid forMOVW
)I
: An immediate integer valid for a data-processing instruction.J
: An immediate integer between -4095 and 4095.K
: An immediate integer whose bitwise inverse is valid for a data-processing instruction. (Can be used with template modifier “B
” to print the inverted value).L
: An immediate integer whose negation is valid for a data-processing instruction. (Can be used with template modifier “n
” to print the negated value).M
: A power of two or an integer between 0 and 32.N
: Invalid immediate constraint.O
: Invalid immediate constraint.r
: A general-purpose 32-bit integer register (r0-r15
).l
: In Thumb2 mode, low 32-bit GPR registers (r0-r7
). In ARM mode, same asr
.h
: In Thumb2 mode, a high 32-bit GPR register (r8-r15
). In ARM mode, invalid.w
: A 32, 64, or 128-bit floating-point/SIMD register in the rangess0-s31
,d0-d31
, orq0-q15
, respectively.t
: A 32, 64, or 128-bit floating-point/SIMD register in the rangess0-s31
,d0-d15
, orq0-q7
, respectively.x
: A 32, 64, or 128-bit floating-point/SIMD register in the rangess0-s15
,d0-d7
, orq0-q3
, respectively.
ARM’s Thumb1 mode:
I
: An immediate integer between 0 and 255.J
: An immediate integer between -255 and -1.K
: An immediate integer between 0 and 255, with optional left-shift by some amount.L
: An immediate integer between -7 and 7.M
: An immediate integer which is a multiple of 4 between 0 and 1020.N
: An immediate integer between 0 and 31.O
: An immediate integer which is a multiple of 4 between -508 and 508.r
: A low 32-bit GPR register (r0-r7
).l
: A low 32-bit GPR register (r0-r7
).h
: A high GPR register (r0-r7
).w
: A 32, 64, or 128-bit floating-point/SIMD register in the rangess0-s31
,d0-d31
, orq0-q15
, respectively.t
: A 32, 64, or 128-bit floating-point/SIMD register in the rangess0-s31
,d0-d15
, orq0-q7
, respectively.x
: A 32, 64, or 128-bit floating-point/SIMD register in the rangess0-s15
,d0-d7
, orq0-q3
, respectively.
Hexagon:
o
,v
: A memory address operand, treated the same as constraintm
, at the moment.r
: A 32 or 64-bit register.
LoongArch:
f
: A floating-point register (if available).k
: A memory operand whose address is formed by a base register and (optionally scaled) index register.l
: A signed 16-bit constant.m
: A memory operand whose address is formed by a base register and offset that is suitable for use in instructions with the same addressing mode as st.w and ld.w.I
: A signed 12-bit constant (for arithmetic instructions).J
: An immediate integer zero.K
: An unsigned 12-bit constant (for logic instructions).ZB
: An address that is held in a general-purpose register. The offset is zero.ZC
: A memory operand whose address is formed by a base register and offset that is suitable for use in instructions with the same addressing mode as ll.w and sc.w.
MSP430:
r
: An 8 or 16-bit register.
MIPS:
I
: An immediate signed 16-bit integer.J
: An immediate integer zero.K
: An immediate unsigned 16-bit integer.L
: An immediate 32-bit integer, where the lower 16 bits are 0.N
: An immediate integer between -65535 and -1.O
: An immediate signed 15-bit integer.P
: An immediate integer between 1 and 65535.m
: A memory address operand. In MIPS-SE mode, allows a base address register plus 16-bit immediate offset. In MIPS mode, just a base register.R
: A memory address operand. In MIPS-SE mode, allows a base address register plus a 9-bit signed offset. In MIPS mode, the same as constraintm
.ZC
: A memory address operand, suitable for use in apref
,ll
, orsc
instruction on the given subtarget (details vary).r
,d
,y
: A 32 or 64-bit GPR register.f
: A 32 or 64-bit FPU register (F0-F31
), or a 128-bit MSA register (W0-W31
). In the case of MSA registers, it is recommended to use thew
argument modifier for compatibility with GCC.c
: A 32-bit or 64-bit GPR register suitable for indirect jump (always25
).l
: Thelo
register, 32 or 64-bit.x
: Invalid.
NVPTX:
b
: A 1-bit integer register.c
orh
: A 16-bit integer register.r
: A 32-bit integer register.l
orN
: A 64-bit integer register.f
: A 32-bit float register.d
: A 64-bit float register.
PowerPC:
I
: An immediate signed 16-bit integer.J
: An immediate unsigned 16-bit integer, shifted left 16 bits.K
: An immediate unsigned 16-bit integer.L
: An immediate signed 16-bit integer, shifted left 16 bits.M
: An immediate integer greater than 31.N
: An immediate integer that is an exact power of 2.O
: The immediate integer constant 0.P
: An immediate integer constant whose negation is a signed 16-bit constant.es
,o
,Q
,Z
,Zy
: A memory address operand, currently treated the same asm
.r
: A 32 or 64-bit integer register.b
: A 32 or 64-bit integer register, excludingR0
(that is:R1-R31
).f
: A 32 or 64-bit float register (F0-F31
),v
: For4 x f32
or4 x f64
types, a 128-bit altivec vectorregister (
V0-V31
).
y
: Condition register (CR0-CR7
).wc
: An individual CR bit in a CR register.wa
,wd
,wf
: Any 128-bit VSX vector register, from the full VSX register set (overlapping both the floating-point and vector register files).ws
: A 32 or 64-bit floating-point register, from the full VSX register set.
RISC-V:
A
: An address operand (using a general-purpose register, without an offset).I
: A 12-bit signed integer immediate operand.J
: A zero integer immediate operand.K
: A 5-bit unsigned integer immediate operand.f
: A 32- or 64-bit floating-point register (requires F or D extension).r
: A 32- or 64-bit general-purpose register (depending on the platformXLEN
).vr
: A vector register. (requires V extension).vm
: A vector register for masking operand. (requires V extension).
Sparc:
I
: An immediate 13-bit signed integer.r
: A 32-bit integer register.f
: Any floating-point register on SparcV8, or a floating-point register in the “low” half of the registers on SparcV9.e
: Any floating-point register. (Same asf
on SparcV8.)
SystemZ:
I
: An immediate unsigned 8-bit integer.J
: An immediate unsigned 12-bit integer.K
: An immediate signed 16-bit integer.L
: An immediate signed 20-bit integer.M
: An immediate integer 0x7fffffff.Q
: A memory address operand with a base address and a 12-bit immediate unsigned displacement.R
: A memory address operand with a base address, a 12-bit immediate unsigned displacement, and an index register.S
: A memory address operand with a base address and a 20-bit immediate signed displacement.T
: A memory address operand with a base address, a 20-bit immediate signed displacement, and an index register.r
ord
: A 32, 64, or 128-bit integer register.a
: A 32, 64, or 128-bit integer address register (excludes R0, which in an address context evaluates as zero).h
: A 32-bit value in the high part of a 64bit data register (LLVM-specific)f
: A 32, 64, or 128-bit floating-point register.
X86:
I
: An immediate integer between 0 and 31.J
: An immediate integer between 0 and 64.K
: An immediate signed 8-bit integer.L
: An immediate integer, 0xff or 0xffff or (in 64-bit mode only) 0xffffffff.M
: An immediate integer between 0 and 3.N
: An immediate unsigned 8-bit integer.O
: An immediate integer between 0 and 127.e
: An immediate 32-bit signed integer.Z
: An immediate 32-bit unsigned integer.q
: An 8, 16, 32, or 64-bit register which can be accessed as an 8-bitl
integer register. On X86-32, this is thea
,b
,c
, andd
registers, and on X86-64, it is all of the integer registers.Q
: An 8, 16, 32, or 64-bit register which can be accessed as an 8-bith
integer register. This is thea
,b
,c
, andd
registers.r
orl
: An 8, 16, 32, or 64-bit integer register.R
: An 8, 16, 32, or 64-bit “legacy” integer register – one which has existed since i386, and can be accessed without the REX prefix.f
: A 32, 64, or 80-bit ‘387 FPU stack pseudo-register.y
: A 64-bit MMX register, if MMX is enabled.v
: If SSE is enabled: a 32 or 64-bit scalar operand, or 128-bit vector operand in a SSE register. If AVX is also enabled, can also be a 256-bit vector operand in an AVX register. If AVX-512 is also enabled, can also be a 512-bit vector operand in an AVX512 register. Otherwise, an error.Ws
: A symbolic reference with an optional constant addend or a label reference.x
: The same asv
, except that when AVX-512 is enabled, thex
code only allocates into the first 16 AVX-512 registers, while thev
code allocates into any of the 32 AVX-512 registers.Y
: The same asx
, if SSE2 is enabled, otherwise an error.A
: Special case: allocates EAX first, then EDX, for a single operand (in 32-bit mode, a 64-bit integer operand will get split into two registers). It is not recommended to use this constraint, as in 64-bit mode, the 64-bit operand will get allocated only to RAX – if two 32-bit operands are needed, you’re better off splitting it yourself, before passing it to the asm statement.
XCore:
r
: A 32-bit integer register.
Asm template argument modifiers¶
In the asm template string, modifiers can be used on the operand reference, like
“${0:n}
”.
The modifiers are, in general, expected to behave the same way they do in GCC. LLVM’s support is often implemented on an ‘as-needed’ basis, to support C inline asm code which was supported by GCC. A mismatch in behavior between LLVM and GCC likely indicates a bug in LLVM.
Target-independent:
c
: Print an immediate integer constant unadorned, without the target-specific immediate punctuation (e.g. no$
prefix).n
: Negate and print immediate integer constant unadorned, without the target-specific immediate punctuation (e.g. no$
prefix).l
: Print as an unadorned label, without the target-specific label punctuation (e.g. no$
prefix).
AArch64:
w
: Print a GPR register with aw*
name instead ofx*
name. E.g., instead ofx30
, printw30
.x
: Print a GPR register with ax*
name. (this is the default, anyhow).b
,h
,s
,d
,q
: Print a floating-point/SIMD register with ab*
,h*
,s*
,d*
, orq*
name, rather than the default ofv*
.
AMDGPU:
r
: No effect.
ARM:
a
: Print an operand as an address (with[
and]
surrounding a register).P
: No effect.q
: No effect.y
: Print a VFP single-precision register as an indexed double (e.g. print asd4[1]
instead ofs9
)B
: Bitwise invert and print an immediate integer constant without#
prefix.L
: Print the low 16-bits of an immediate integer constant.M
: Print as a register set suitable for ldm/stm. Also prints all register operands subsequent to the specified one (!), so use carefully.Q
: Print the low-order register of a register-pair, or the low-order register of a two-register operand.R
: Print the high-order register of a register-pair, or the high-order register of a two-register operand.H
: Print the second register of a register-pair. (On a big-endian system,H
is equivalent toQ
, and on little-endian system,H
is equivalent toR
.)e
: Print the low doubleword register of a NEON quad register.f
: Print the high doubleword register of a NEON quad register.m
: Print the base register of a memory operand without the[
and]
adornment.
Hexagon:
L
: Print the second register of a two-register operand. Requires that it has been allocated consecutively to the first.I
: Print the letter ‘i’ if the operand is an integer constant, otherwise nothing. Used to print ‘addi’ vs ‘add’ instructions.
LoongArch:
z
: Print $zero register if operand is zero, otherwise print it normally.
MSP430:
No additional modifiers.
MIPS:
X
: Print an immediate integer as hexadecimalx
: Print the low 16 bits of an immediate integer as hexadecimal.d
: Print an immediate integer as decimal.m
: Subtract one and print an immediate integer as decimal.z
: Print $0 if an immediate zero, otherwise print normally.L
: Print the low-order register of a two-register operand, or prints the address of the low-order word of a double-word memory operand.M
: Print the high-order register of a two-register operand, or prints the address of the high-order word of a double-word memory operand.D
: Print the second register of a two-register operand, or prints the second word of a double-word memory operand. (On a big-endian system,D
is equivalent toL
, and on little-endian system,D
is equivalent toM
.)w
: No effect. Provided for compatibility with GCC which requires this modifier in order to print MSA registers (W0-W31
) with thef
constraint.
NVPTX:
r
: No effect.
PowerPC:
L
: Print the second register of a two-register operand. Requires that it has been allocated consecutively to the first.I
: Print the letter ‘i’ if the operand is an integer constant, otherwise nothing. Used to print ‘addi’ vs ‘add’ instructions.y
: For a memory operand, prints formatter for a two-register X-form instruction. (Currently always printsr0,OPERAND
).U
: Prints ‘u’ if the memory operand is an update form, and nothing otherwise. (NOTE: LLVM does not support update form, so this will currently always print nothing)X
: Prints ‘x’ if the memory operand is an indexed form. (NOTE: LLVM does not support indexed form, so this will currently always print nothing)
RISC-V:
i
: Print the letter ‘i’ if the operand is not a register, otherwise print nothing. Used to print ‘addi’ vs ‘add’ instructions, etc.z
: Print the registerzero
if an immediate zero, otherwise print normally.
Sparc:
r
: No effect.
SystemZ:
SystemZ implements only n
, and does not support any of the other
target-independent modifiers.
X86:
c
: Print an unadorned integer or symbol name. (The latter is target-specific behavior for this typically target-independent modifier).A
: Print a register name with a ‘*
’ before it.b
: Print an 8-bit register name (e.g.al
); do nothing on a memory operand.h
: Print the upper 8-bit register name (e.g.ah
); do nothing on a memory operand.w
: Print the 16-bit register name (e.g.ax
); do nothing on a memory operand.k
: Print the 32-bit register name (e.g.eax
); do nothing on a memory operand.q
: Print the 64-bit register name (e.g.rax
), if 64-bit registers are available, otherwise the 32-bit register name; do nothing on a memory operand.n
: Negate and print an unadorned integer, or, for operands other than an immediate integer (e.g. a relocatable symbol expression), print a ‘-’ before the operand. (The behavior for relocatable symbol expressions is a target-specific behavior for this typically target-independent modifier)H
: Print a memory reference with additional offset +8.p
: Print a raw symbol name (without syntax-specific prefixes).P
: Print a memory reference used as the argument of a call instruction or used with explicit base reg and index reg as its offset. So it can not use additional regs to present the memory reference. (E.g. omit(rip)
, even though it’s PC-relative.)
XCore:
No additional modifiers.
Inline Asm Metadata¶
The call instructions that wrap inline asm nodes may have a
“!srcloc
” MDNode attached to it that contains a list of constant
integers. If present, the code generator will use the integer as the
location cookie value when report errors through the LLVMContext
error reporting mechanisms. This allows a front-end to correlate backend
errors that occur with inline asm back to the source code that produced
it. For example:
call void asm sideeffect "something bad", ""(), !srcloc !42
...
!42 = !{ i32 1234567 }
It is up to the front-end to make sense of the magic numbers it places in the IR. If the MDNode contains multiple constants, the code generator will use the one that corresponds to the line of the asm that the error occurs on.
Metadata¶
LLVM IR allows metadata to be attached to instructions and global objects in the program that can convey extra information about the code to the optimizers and code generator. One example application of metadata is source-level debug information. There are two metadata primitives: strings and nodes.
Metadata does not have a type, and is not a value. If referenced from a
call
instruction, it uses the metadata
type.
All metadata are identified in syntax by an exclamation point (’!
’).
Metadata Nodes and Metadata Strings¶
A metadata string is a string surrounded by double quotes. It can
contain any character by escaping non-printable characters with
“\xx
” where “xx
” is the two digit hex code. For example:
“!"test\00"
”.
Metadata nodes are represented with notation similar to structure constants (a comma separated list of elements, surrounded by braces and preceded by an exclamation point). Metadata nodes can have any values as their operand. For example:
!{ !"test\00", i32 10}
Metadata nodes that aren’t uniqued use the distinct
keyword. For example:
!0 = distinct !{!"test\00", i32 10}
distinct
nodes are useful when nodes shouldn’t be merged based on their
content. They can also occur when transformations cause uniquing collisions
when metadata operands change.
A named metadata is a collection of metadata nodes, which can be looked up in the module symbol table. For example:
!foo = !{!4, !3}
Metadata can be used as function arguments. Here the llvm.dbg.value
intrinsic is using three metadata arguments:
call void @llvm.dbg.value(metadata !24, metadata !25, metadata !26)
Metadata can be attached to an instruction. Here metadata !21
is attached
to the add
instruction using the !dbg
identifier:
%indvar.next = add i64 %indvar, 1, !dbg !21
Instructions may not have multiple metadata attachments with the same identifier.
Metadata can also be attached to a function or a global variable. Here metadata
!22
is attached to the f1
and f2
functions, and the globals g1
and g2
using the !dbg
identifier:
declare !dbg !22 void @f1()
define void @f2() !dbg !22 {
ret void
}
@g1 = global i32 0, !dbg !22
@g2 = external global i32, !dbg !22
Unlike instructions, global objects (functions and global variables) may have multiple metadata attachments with the same identifier.
A transformation is required to drop any metadata attachment that it
does not know or know it can’t preserve. Currently there is an
exception for metadata attachment to globals for !func_sanitize
,
!type
, !absolute_symbol
and !associated
which can’t be
unconditionally dropped unless the global is itself deleted.
Metadata attached to a module using named metadata may not be dropped, with
the exception of debug metadata (named metadata with the name !llvm.dbg.*
).
More information about specific metadata nodes recognized by the optimizers and code generator is found below.
Specialized Metadata Nodes¶
Specialized metadata nodes are custom data structures in metadata (as opposed to generic tuples). Their fields are labelled, and can be specified in any order.
These aren’t inherently debug info centric, but currently all the specialized metadata nodes are related to debug info.
DICompileUnit¶
DICompileUnit
nodes represent a compile unit. DICompileUnit
nodes must
be distinct
. The enums:
, retainedTypes:
, globals:
, imports:
and macros:
fields are tuples containing the debug info to be emitted along
with the compile unit, regardless of code optimizations (some nodes are only
emitted if there are references to them from instructions). The
debugInfoForProfiling:
field is a boolean indicating whether or not
line-table discriminators are updated to provide more-accurate debug info for
profiling results.
!0 = distinct !DICompileUnit(language: DW_LANG_C99, file: !1, producer: "clang",
isOptimized: true, flags: "-O2", runtimeVersion: 2,
splitDebugFilename: "abc.debug", emissionKind: FullDebug,
enums: !2, retainedTypes: !3, globals: !4, imports: !5,
macros: !6, dwoId: 0x0abcd)
Compile unit descriptors provide the root scope for objects declared in a
specific compilation unit. File descriptors are defined using this scope. These
descriptors are collected by a named metadata node !llvm.dbg.cu
. They keep
track of global variables, type information, and imported entities (declarations
and namespaces).
DIFile¶
DIFile
nodes represent files. The filename:
can include slashes.
!0 = !DIFile(filename: "path/to/file", directory: "/path/to/dir",
checksumkind: CSK_MD5,
checksum: "000102030405060708090a0b0c0d0e0f")
Files are sometimes used in scope:
fields, and are the only valid target
for file:
fields.
The checksum:
and checksumkind:
fields are optional. If one of these
fields is present, then the other is required to be present as well. Valid
values for checksumkind:
field are: {CSK_MD5, CSK_SHA1, CSK_SHA256}
DIBasicType¶
DIBasicType
nodes represent primitive types, such as int
, bool
and
float
. tag:
defaults to DW_TAG_base_type
.
!0 = !DIBasicType(name: "unsigned char", size: 8, align: 8,
encoding: DW_ATE_unsigned_char)
!1 = !DIBasicType(tag: DW_TAG_unspecified_type, name: "decltype(nullptr)")
The encoding:
describes the details of the type. Usually it’s one of the
following:
DW_ATE_address = 1
DW_ATE_boolean = 2
DW_ATE_float = 4
DW_ATE_signed = 5
DW_ATE_signed_char = 6
DW_ATE_unsigned = 7
DW_ATE_unsigned_char = 8
DISubroutineType¶
DISubroutineType
nodes represent subroutine types. Their types:
field
refers to a tuple; the first operand is the return type, while the rest are the
types of the formal arguments in order. If the first operand is null
, that
represents a function with no return value (such as void foo() {}
in C++).
!0 = !BasicType(name: "int", size: 32, align: 32, DW_ATE_signed)
!1 = !BasicType(name: "char", size: 8, align: 8, DW_ATE_signed_char)
!2 = !DISubroutineType(types: !{null, !0, !1}) ; void (int, char)
DIDerivedType¶
DIDerivedType
nodes represent types derived from other types, such as
qualified types.
!0 = !DIBasicType(name: "unsigned char", size: 8, align: 8,
encoding: DW_ATE_unsigned_char)
!1 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !0, size: 32,
align: 32)
The following tag:
values are valid:
DW_TAG_member = 13
DW_TAG_pointer_type = 15
DW_TAG_reference_type = 16
DW_TAG_typedef = 22
DW_TAG_inheritance = 28
DW_TAG_ptr_to_member_type = 31
DW_TAG_const_type = 38
DW_TAG_friend = 42
DW_TAG_volatile_type = 53
DW_TAG_restrict_type = 55
DW_TAG_atomic_type = 71
DW_TAG_immutable_type = 75
DW_TAG_member
is used to define a member of a composite type. The type of the member is the baseType:
. The
offset:
is the member’s bit offset. If the composite type has an ODR
identifier:
and does not set flags: DIFwdDecl
, then the member is
uniqued based only on its name:
and scope:
.
DW_TAG_inheritance
and DW_TAG_friend
are used in the elements:
field of composite types to describe parents and
friends.
DW_TAG_typedef
is used to provide a name for the baseType:
.
DW_TAG_pointer_type
, DW_TAG_reference_type
, DW_TAG_const_type
,
DW_TAG_volatile_type
, DW_TAG_restrict_type
, DW_TAG_atomic_type
and
DW_TAG_immutable_type
are used to qualify the baseType:
.
Note that the void *
type is expressed as a type derived from NULL.
DICompositeType¶
DICompositeType
nodes represent types composed of other types, like
structures and unions. elements:
points to a tuple of the composed types.
If the source language supports ODR, the identifier:
field gives the unique
identifier used for type merging between modules. When specified,
subprogram declarations and member
derived types that reference the ODR-type in their
scope:
change uniquing rules.
For a given identifier:
, there should only be a single composite type that
does not have flags: DIFlagFwdDecl
set. LLVM tools that link modules
together will unique such definitions at parse time via the identifier:
field, even if the nodes are distinct
.
!0 = !DIEnumerator(name: "SixKind", value: 7)
!1 = !DIEnumerator(name: "SevenKind", value: 7)
!2 = !DIEnumerator(name: "NegEightKind", value: -8)
!3 = !DICompositeType(tag: DW_TAG_enumeration_type, name: "Enum", file: !12,
line: 2, size: 32, align: 32, identifier: "_M4Enum",
elements: !{!0, !1, !2})
The following tag:
values are valid:
DW_TAG_array_type = 1
DW_TAG_class_type = 2
DW_TAG_enumeration_type = 4
DW_TAG_structure_type = 19
DW_TAG_union_type = 23
For DW_TAG_array_type
, the elements:
should be subrange
descriptors, each representing the range of subscripts at that
level of indexing. The DIFlagVector
flag to flags:
indicates that an
array type is a native packed vector. The optional dataLocation
is a
DIExpression that describes how to get from an object’s address to the actual
raw data, if they aren’t equivalent. This is only supported for array types,
particularly to describe Fortran arrays, which have an array descriptor in
addition to the array data. Alternatively it can also be DIVariable which
has the address of the actual raw data. The Fortran language supports pointer
arrays which can be attached to actual arrays, this attachment between pointer
and pointee is called association. The optional associated
is a
DIExpression that describes whether the pointer array is currently associated.
The optional allocated
is a DIExpression that describes whether the
allocatable array is currently allocated. The optional rank
is a
DIExpression that describes the rank (number of dimensions) of fortran assumed
rank array (rank is known at runtime).
For DW_TAG_enumeration_type
, the elements:
should be enumerator
descriptors, each representing the definition of an enumeration
value for the set. All enumeration type descriptors are collected in the
enums:
field of the compile unit.
For DW_TAG_structure_type
, DW_TAG_class_type
, and
DW_TAG_union_type
, the elements:
should be derived types with tag: DW_TAG_member
, tag: DW_TAG_inheritance
, or
tag: DW_TAG_friend
; or subprograms with
isDefinition: false
.
DISubrange¶
DISubrange
nodes are the elements for DW_TAG_array_type
variants of
DICompositeType.
count: -1
indicates an empty array.count: !10
describes the count with a DILocalVariable.count: !12
describes the count with a DIGlobalVariable.
!0 = !DISubrange(count: 5, lowerBound: 0) ; array counting from 0
!1 = !DISubrange(count: 5, lowerBound: 1) ; array counting from 1
!2 = !DISubrange(count: -1) ; empty array.
; Scopes used in rest of example
!6 = !DIFile(filename: "vla.c", directory: "/path/to/file")
!7 = distinct !DICompileUnit(language: DW_LANG_C99, file: !6)
!8 = distinct !DISubprogram(name: "foo", scope: !7, file: !6, line: 5)
; Use of local variable as count value
!9 = !DIBasicType(name: "int", size: 32, encoding: DW_ATE_signed)
!10 = !DILocalVariable(name: "count", scope: !8, file: !6, line: 42, type: !9)
!11 = !DISubrange(count: !10, lowerBound: 0)
; Use of global variable as count value
!12 = !DIGlobalVariable(name: "count", scope: !8, file: !6, line: 22, type: !9)
!13 = !DISubrange(count: !12, lowerBound: 0)
DIEnumerator¶
DIEnumerator
nodes are the elements for DW_TAG_enumeration_type
variants of DICompositeType.
!0 = !DIEnumerator(name: "SixKind", value: 7)
!1 = !DIEnumerator(name: "SevenKind", value: 7)
!2 = !DIEnumerator(name: "NegEightKind", value: -8)
DITemplateTypeParameter¶
DITemplateTypeParameter
nodes represent type parameters to generic source
language constructs. They are used (optionally) in DICompositeType and
DISubprogram templateParams:
fields.
!0 = !DITemplateTypeParameter(name: "Ty", type: !1)
DITemplateValueParameter¶
DITemplateValueParameter
nodes represent value parameters to generic source
language constructs. tag:
defaults to DW_TAG_template_value_parameter
,
but if specified can also be set to DW_TAG_GNU_template_template_param
or
DW_TAG_GNU_template_param_pack
. They are used (optionally) in
DICompositeType and DISubprogram templateParams:
fields.
!0 = !DITemplateValueParameter(name: "Ty", type: !1, value: i32 7)
DINamespace¶
DINamespace
nodes represent namespaces in the source language.
!0 = !DINamespace(name: "myawesomeproject", scope: !1, file: !2, line: 7)
DIGlobalVariable¶
DIGlobalVariable
nodes represent global variables in the source language.
@foo = global i32, !dbg !0
!0 = !DIGlobalVariableExpression(var: !1, expr: !DIExpression())
!1 = !DIGlobalVariable(name: "foo", linkageName: "foo", scope: !2,
file: !3, line: 7, type: !4, isLocal: true,
isDefinition: false, declaration: !5)
DIGlobalVariableExpression¶
DIGlobalVariableExpression
nodes tie a DIGlobalVariable together
with a DIExpression.
@lower = global i32, !dbg !0
@upper = global i32, !dbg !1
!0 = !DIGlobalVariableExpression(
var: !2,
expr: !DIExpression(DW_OP_LLVM_fragment, 0, 32)
)
!1 = !DIGlobalVariableExpression(
var: !2,
expr: !DIExpression(DW_OP_LLVM_fragment, 32, 32)
)
!2 = !DIGlobalVariable(name: "split64", linkageName: "split64", scope: !3,
file: !4, line: 8, type: !5, declaration: !6)
All global variable expressions should be referenced by the globals: field of a compile unit.
DISubprogram¶
DISubprogram
nodes represent functions from the source language. A distinct
DISubprogram
may be attached to a function definition using !dbg
metadata. A unique DISubprogram
may be attached to a function declaration
used for call site debug info. The retainedNodes:
field is a list of
variables and labels that must be
retained, even if their IR counterparts are optimized out of the IR. The
type:
field must point at an DISubroutineType.
When spFlags: DISPFlagDefinition
is not present, subprograms describe a
declaration in the type tree as opposed to a definition of a function. In this
case, the declaration
field must be empty. If the scope is a composite type
with an ODR identifier:
and that does not set flags: DIFwdDecl
, then
the subprogram declaration is uniqued based only on its linkageName:
and
scope:
.
define void @_Z3foov() !dbg !0 {
...
}
!0 = distinct !DISubprogram(name: "foo", linkageName: "_Zfoov", scope: !1,
file: !2, line: 7, type: !3,
spFlags: DISPFlagDefinition | DISPFlagLocalToUnit,
scopeLine: 8, containingType: !4,
virtuality: DW_VIRTUALITY_pure_virtual,
virtualIndex: 10, flags: DIFlagPrototyped,
isOptimized: true, unit: !5, templateParams: !6,
declaration: !7, retainedNodes: !8,
thrownTypes: !9)
DILexicalBlock¶
DILexicalBlock
nodes describe nested blocks within a subprogram. The line number and column numbers are used to distinguish
two lexical blocks at same depth. They are valid targets for scope:
fields.
!0 = distinct !DILexicalBlock(scope: !1, file: !2, line: 7, column: 35)
Usually lexical blocks are distinct
to prevent node merging based on
operands.
DILexicalBlockFile¶
DILexicalBlockFile
nodes are used to discriminate between sections of a
lexical block. The file:
field can be changed to
indicate textual inclusion, or the discriminator:
field can be used to
discriminate between control flow within a single block in the source language.
!0 = !DILexicalBlock(scope: !3, file: !4, line: 7, column: 35)
!1 = !DILexicalBlockFile(scope: !0, file: !4, discriminator: 0)
!2 = !DILexicalBlockFile(scope: !0, file: !4, discriminator: 1)
DILocation¶
DILocation
nodes represent source debug locations. The scope:
field is
mandatory, and points at an DILexicalBlockFile, an
DILexicalBlock, or an DISubprogram.
!0 = !DILocation(line: 2900, column: 42, scope: !1, inlinedAt: !2)
DILocalVariable¶
DILocalVariable
nodes represent local variables in the source language. If
the arg:
field is set to non-zero, then this variable is a subprogram
parameter, and it will be included in the retainedNodes:
field of its
DISubprogram.
!0 = !DILocalVariable(name: "this", arg: 1, scope: !3, file: !2, line: 7,
type: !3, flags: DIFlagArtificial)
!1 = !DILocalVariable(name: "x", arg: 2, scope: !4, file: !2, line: 7,
type: !3)
!2 = !DILocalVariable(name: "y", scope: !5, file: !2, line: 7, type: !3)
DIExpression¶
DIExpression
nodes represent expressions that are inspired by the DWARF
expression language. DIExpression
nodes must not be distinct
, and are
canonically printed inline at each use. They are used in debug
intrinsics (such as llvm.dbg.declare
and
llvm.dbg.value
) to describe how the referenced LLVM variable relates to the
source language variable. Debug intrinsics are interpreted left-to-right: start
by pushing the value/address operand of the intrinsic onto a stack, then
repeatedly push and evaluate opcodes from the DIExpression until the final
variable description is produced.
The current supported opcode vocabulary is limited:
DW_OP_deref
dereferences the top of the expression stack.DW_OP_plus
pops the last two entries from the expression stack, adds them together and appends the result to the expression stack.DW_OP_minus
pops the last two entries from the expression stack, subtracts the last entry from the second last entry and appends the result to the expression stack.DW_OP_plus_uconst, 93
adds93
to the working expression.DW_OP_LLVM_fragment, 16, 8
specifies the offset and size (16
and8
here, respectively) of the variable fragment from the working expression. Note that contrary to DW_OP_bit_piece, the offset is describing the location within the described source variable.DW_OP_LLVM_convert, 16, DW_ATE_signed
specifies a bit size and encoding (16
andDW_ATE_signed
here, respectively) to which the top of the expression stack is to be converted. Maps into aDW_OP_convert
operation that references a base type constructed from the supplied values.DW_OP_LLVM_tag_offset, tag_offset
specifies that a memory tag should be optionally applied to the pointer. The memory tag is derived from the given tag offset in an implementation-defined manner.DW_OP_swap
swaps top two stack entries.DW_OP_xderef
provides extended dereference mechanism. The entry at the top of the stack is treated as an address. The second stack entry is treated as an address space identifier.DW_OP_stack_value
marks a constant value.DW_OP_LLVM_entry_value, N
refers to the value a register had upon function entry. When targeting DWARF, aDBG_VALUE(reg, ..., DIExpression(DW_OP_LLVM_entry_value, 1, ...)
is lowered toDW_OP_entry_value [reg], ...
, which pushes the valuereg
had upon function entry onto the DWARF expression stack.The next
(N - 1)
operations will be part of theDW_OP_entry_value
block argument. For example,!DIExpression(DW_OP_LLVM_entry_value, 1, DW_OP_plus_uconst, 123, DW_OP_stack_value)
specifies an expression where the entry value ofreg
is pushed onto the stack, and is added with 123. Due to framework limitationsN
must be 1, in other words,DW_OP_entry_value
always refers to the value/address operand of the instruction.Because
DW_OP_LLVM_entry_value
is defined in terms of registers, it is usually used in MIR, but it is also allowed in LLVM IR when targeting a swiftasync argument. The operation is introduced by:LiveDebugValues
pass, which applies it to function parameters that are unmodified throughout the function. Support is limited to simple register location descriptions, or as indirect locations (e.g., parameters passed-by-value to a callee via a pointer to a temporary copy made in the caller).AsmPrinter
pass when a call site parameter value (DW_AT_call_site_parameter_value
) is represented as entry value of the parameter.CoroSplit
pass, which may move variables from allocas into a coroutine frame. If the coroutine frame is a swiftasync argument, the variable is described with anDW_OP_LLVM_entry_value
operation.
DW_OP_LLVM_arg, N
is used in debug intrinsics that refer to more than one value, such as one that calculates the sum of two registers. This is always used in combination with an ordered list of values, such thatDW_OP_LLVM_arg, N
refers to theN
th element in that list. For example,!DIExpression(DW_OP_LLVM_arg, 0, DW_OP_LLVM_arg, 1, DW_OP_minus, DW_OP_stack_value)
used with the list(%reg1, %reg2)
would evaluate to%reg1 - reg2
. This list of values should be provided by the containing intrinsic/instruction.DW_OP_breg
(orDW_OP_bregx
) represents a content on the provided signed offset of the specified register. The opcode is only generated by theAsmPrinter
pass to describe call site parameter value which requires an expression over two registers.DW_OP_push_object_address
pushes the address of the object which can then serve as a descriptor in subsequent calculation. This opcode can be used to calculate bounds of fortran allocatable array which has array descriptors.DW_OP_over
duplicates the entry currently second in the stack at the top of the stack. This opcode can be used to calculate bounds of fortran assumed rank array which has rank known at run time and current dimension number is implicitly first element of the stack.DW_OP_LLVM_implicit_pointer
It specifies the dereferenced value. It can be used to represent pointer variables which are optimized out but the value it points to is known. This operator is required as it is different than DWARF operator DW_OP_implicit_pointer in representation and specification (number and types of operands) and later can not be used as multiple level.
IR for "*ptr = 4;"
--------------
call void @llvm.dbg.value(metadata i32 4, metadata !17,
metadata !DIExpression(DW_OP_LLVM_implicit_pointer)))
!17 = !DILocalVariable(name: "ptr1", scope: !12, file: !3, line: 5,
type: !18)
!18 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !19, size: 64)
!19 = !DIBasicType(name: "int", size: 32, encoding: DW_ATE_signed)
IR for "**ptr = 4;"
--------------
call void @llvm.dbg.value(metadata i32 4, metadata !17,
metadata !DIExpression(DW_OP_LLVM_implicit_pointer,
DW_OP_LLVM_implicit_pointer)))
!17 = !DILocalVariable(name: "ptr1", scope: !12, file: !3, line: 5,
type: !18)
!18 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !19, size: 64)
!19 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !20, size: 64)
!20 = !DIBasicType(name: "int", size: 32, encoding: DW_ATE_signed)
DWARF specifies three kinds of simple location descriptions: Register, memory,
and implicit location descriptions. Note that a location description is
defined over certain ranges of a program, i.e the location of a variable may
change over the course of the program. Register and memory location
descriptions describe the concrete location of a source variable (in the
sense that a debugger might modify its value), whereas implicit locations
describe merely the actual value of a source variable which might not exist
in registers or in memory (see DW_OP_stack_value
).
A llvm.dbg.declare
intrinsic describes an indirect value (the address) of a
source variable. The first operand of the intrinsic must be an address of some
kind. A DIExpression attached to the intrinsic refines this address to produce a
concrete location for the source variable.
A llvm.dbg.value
intrinsic describes the direct value of a source variable.
The first operand of the intrinsic may be a direct or indirect value. A
DIExpression attached to the intrinsic refines the first operand to produce a
direct value. For example, if the first operand is an indirect value, it may be
necessary to insert DW_OP_deref
into the DIExpression in order to produce a
valid debug intrinsic.
Note
A DIExpression is interpreted in the same way regardless of which kind of debug intrinsic it’s attached to.
!0 = !DIExpression(DW_OP_deref)
!1 = !DIExpression(DW_OP_plus_uconst, 3)
!1 = !DIExpression(DW_OP_constu, 3, DW_OP_plus)
!2 = !DIExpression(DW_OP_bit_piece, 3, 7)
!3 = !DIExpression(DW_OP_deref, DW_OP_constu, 3, DW_OP_plus, DW_OP_LLVM_fragment, 3, 7)
!4 = !DIExpression(DW_OP_constu, 2, DW_OP_swap, DW_OP_xderef)
!5 = !DIExpression(DW_OP_constu, 42, DW_OP_stack_value)
DIAssignID¶
DIAssignID
nodes have no operands and are always distinct. They are used to
link together @llvm.dbg.assign intrinsics (debug
intrinsics) and instructions that store in IR. See Debug Info
Assignment Tracking for more info.
store i32 %a, ptr %a.addr, align 4, !DIAssignID !2
llvm.dbg.assign(metadata %a, metadata !1, metadata !DIExpression(), !2, metadata %a.addr, metadata !DIExpression()), !dbg !3
!2 = distinct !DIAssignID()
DIArgList¶
DIArgList
nodes hold a list of constant or SSA value references.
DIArgList
must not be distinct
, must only be used as an argument to a
function call, and must appear inline at each use. DIArgList
may refer to
function-local values of the containing function. DIArgList
nodes are used
in debug intrinsics (currently only in
llvm.dbg.value
) in combination with a DIExpression
that uses the
DW_OP_LLVM_arg
operator.
llvm.dbg.value(metadata !DIArgList(i32 %a, i32 %b),
metadata !16,
metadata !DIExpression(DW_OP_LLVM_arg, 0, DW_OP_LLVM_arg, 1, DW_OP_plus))
DIFlags¶
These flags encode various properties of DINodes.
The ExportSymbols flag marks a class, struct or union whose members may be referenced as if they were defined in the containing class or union. This flag is used to decide whether the DW_AT_export_symbols can be used for the structure type.
DIObjCProperty¶
DIObjCProperty
nodes represent Objective-C property nodes.
!3 = !DIObjCProperty(name: "foo", file: !1, line: 7, setter: "setFoo",
getter: "getFoo", attributes: 7, type: !2)
DIImportedEntity¶
DIImportedEntity
nodes represent entities (such as modules) imported into a
compile unit. The elements
field is a list of renamed entities (such as
variables and subprograms) in the imported entity (such as module).
!2 = !DIImportedEntity(tag: DW_TAG_imported_module, name: "foo", scope: !0,
entity: !1, line: 7, elements: !3)
!3 = !{!4}
!4 = !DIImportedEntity(tag: DW_TAG_imported_declaration, name: "bar", scope: !0,
entity: !5, line: 7)
DIMacro¶
DIMacro
nodes represent definition or undefinition of a macro identifiers.
The name:
field is the macro identifier, followed by macro parameters when
defining a function-like macro, and the value
field is the token-string
used to expand the macro identifier.
!2 = !DIMacro(macinfo: DW_MACINFO_define, line: 7, name: "foo(x)",
value: "((x) + 1)")
!3 = !DIMacro(macinfo: DW_MACINFO_undef, line: 30, name: "foo")
DIMacroFile¶
DIMacroFile
nodes represent inclusion of source files.
The nodes:
field is a list of DIMacro
and DIMacroFile
nodes that
appear in the included source file.
!2 = !DIMacroFile(macinfo: DW_MACINFO_start_file, line: 7, file: !2,
nodes: !3)
DILabel¶
DILabel
nodes represent labels within a DISubprogram. All fields of
a DILabel
are mandatory. The scope:
field must be one of either a
DILexicalBlockFile, a DILexicalBlock, or a DISubprogram.
The name:
field is the label identifier. The file:
field is the
DIFile the label is present in. The line:
field is the source line
within the file where the label is declared.
!2 = !DILabel(scope: !0, name: "foo", file: !1, line: 7)
‘tbaa
’ Metadata¶
In LLVM IR, memory does not have types, so LLVM’s own type system is not suitable for doing type based alias analysis (TBAA). Instead, metadata is added to the IR to describe a type system of a higher level language. This can be used to implement C/C++ strict type aliasing rules, but it can also be used to implement custom alias analysis behavior for other languages.
This description of LLVM’s TBAA system is broken into two parts: Semantics talks about high level issues, and Representation talks about the metadata encoding of various entities.
It is always possible to trace any TBAA node to a “root” TBAA node (details
in the Representation section). TBAA
nodes with different roots have an unknown aliasing relationship, and LLVM
conservatively infers MayAlias
between them. The rules mentioned in
this section only pertain to TBAA nodes living under the same root.
Semantics¶
The TBAA metadata system, referred to as “struct path TBAA” (not to be
confused with tbaa.struct
), consists of the following high level
concepts: Type Descriptors, further subdivided into scalar type
descriptors and struct type descriptors; and Access Tags.
Type descriptors describe the type system of the higher level language being compiled. Scalar type descriptors describe types that do not contain other types. Each scalar type has a parent type, which must also be a scalar type or the TBAA root. Via this parent relation, scalar types within a TBAA root form a tree. Struct type descriptors denote types that contain a sequence of other type descriptors, at known offsets. These contained type descriptors can either be struct type descriptors themselves or scalar type descriptors.
Access tags are metadata nodes attached to load and store instructions. Access tags use type descriptors to describe the location being accessed in terms of the type system of the higher level language. Access tags are tuples consisting of a base type, an access type and an offset. The base type is a scalar type descriptor or a struct type descriptor, the access type is a scalar type descriptor, and the offset is a constant integer.
The access tag (BaseTy, AccessTy, Offset)
can describe one of two
things:
If
BaseTy
is a struct type, the tag describes a memory access (load or store) of a value of typeAccessTy
contained in the struct typeBaseTy
at offsetOffset
.If
BaseTy
is a scalar type,Offset
must be 0 andBaseTy
andAccessTy
must be the same; and the access tag describes a scalar access with scalar typeAccessTy
.
We first define an ImmediateParent
relation on (BaseTy, Offset)
tuples this way:
If
BaseTy
is a scalar type thenImmediateParent(BaseTy, 0)
is(ParentTy, 0)
whereParentTy
is the parent of the scalar type as described in the TBAA metadata.ImmediateParent(BaseTy, Offset)
is undefined ifOffset
is non-zero.If
BaseTy
is a struct type thenImmediateParent(BaseTy, Offset)
is(NewTy, NewOffset)
whereNewTy
is the type contained inBaseTy
at offsetOffset
andNewOffset
isOffset
adjusted to be relative within that inner type.
A memory access with an access tag (BaseTy1, AccessTy1, Offset1)
aliases a memory access with an access tag (BaseTy2, AccessTy2,
Offset2)
if either (BaseTy1, Offset1)
is reachable from (Base2,
Offset2)
via the Parent
relation or vice versa.
As a concrete example, the type descriptor graph for the following program
struct Inner {
int i; // offset 0
float f; // offset 4
};
struct Outer {
float f; // offset 0
double d; // offset 4
struct Inner inner_a; // offset 12
};
void f(struct Outer* outer, struct Inner* inner, float* f, int* i, char* c) {
outer->f = 0; // tag0: (OuterStructTy, FloatScalarTy, 0)
outer->inner_a.i = 0; // tag1: (OuterStructTy, IntScalarTy, 12)
outer->inner_a.f = 0.0; // tag2: (OuterStructTy, FloatScalarTy, 16)
*f = 0.0; // tag3: (FloatScalarTy, FloatScalarTy, 0)
}
is (note that in C and C++, char
can be used to access any arbitrary
type):
Root = "TBAA Root"
CharScalarTy = ("char", Root, 0)
FloatScalarTy = ("float", CharScalarTy, 0)
DoubleScalarTy = ("double", CharScalarTy, 0)
IntScalarTy = ("int", CharScalarTy, 0)
InnerStructTy = {"Inner" (IntScalarTy, 0), (FloatScalarTy, 4)}
OuterStructTy = {"Outer", (FloatScalarTy, 0), (DoubleScalarTy, 4),
(InnerStructTy, 12)}
with (e.g.) ImmediateParent(OuterStructTy, 12)
= (InnerStructTy,
0)
, ImmediateParent(InnerStructTy, 0)
= (IntScalarTy, 0)
, and
ImmediateParent(IntScalarTy, 0)
= (CharScalarTy, 0)
.
Representation¶
The root node of a TBAA type hierarchy is an MDNode
with 0 operands or
with exactly one MDString
operand.
Scalar type descriptors are represented as an MDNode
s with two
operands. The first operand is an MDString
denoting the name of the
struct type. LLVM does not assign meaning to the value of this operand, it
only cares about it being an MDString
. The second operand is an
MDNode
which points to the parent for said scalar type descriptor,
which is either another scalar type descriptor or the TBAA root. Scalar
type descriptors can have an optional third argument, but that must be the
constant integer zero.
Struct type descriptors are represented as MDNode
s with an odd number
of operands greater than 1. The first operand is an MDString
denoting
the name of the struct type. Like in scalar type descriptors the actual
value of this name operand is irrelevant to LLVM. After the name operand,
the struct type descriptors have a sequence of alternating MDNode
and
ConstantInt
operands. With N starting from 1, the 2N - 1 th operand,
an MDNode
, denotes a contained field, and the 2N th operand, a
ConstantInt
, is the offset of the said contained field. The offsets
must be in non-decreasing order.
Access tags are represented as MDNode
s with either 3 or 4 operands.
The first operand is an MDNode
pointing to the node representing the
base type. The second operand is an MDNode
pointing to the node
representing the access type. The third operand is a ConstantInt
that
states the offset of the access. If a fourth field is present, it must be
a ConstantInt
valued at 0 or 1. If it is 1 then the access tag states
that the location being accessed is “constant” (meaning
pointsToConstantMemory
should return true; see other useful
AliasAnalysis methods). The TBAA root of
the access type and the base type of an access tag must be the same, and
that is the TBAA root of the access tag.
‘tbaa.struct
’ Metadata¶
The llvm.memcpy is often used to implement aggregate assignment operations in C and similar languages, however it is defined to copy a contiguous region of memory, which is more than strictly necessary for aggregate types which contain holes due to padding. Also, it doesn’t contain any TBAA information about the fields of the aggregate.
!tbaa.struct
metadata can describe which memory subregions in a
memcpy are padding and what the TBAA tags of the struct are.
The current metadata format is very simple. !tbaa.struct
metadata
nodes are a list of operands which are in conceptual groups of three.
For each group of three, the first operand gives the byte offset of a
field in bytes, the second gives its size in bytes, and the third gives
its tbaa tag. e.g.:
!4 = !{ i64 0, i64 4, !1, i64 8, i64 4, !2 }
This describes a struct with two fields. The first is at offset 0 bytes with size 4 bytes, and has tbaa tag !1. The second is at offset 8 bytes and has size 4 bytes and has tbaa tag !2.
Note that the fields need not be contiguous. In this example, there is a 4 byte gap between the two fields. This gap represents padding which does not carry useful data and need not be preserved.
‘noalias
’ and ‘alias.scope
’ Metadata¶
noalias
and alias.scope
metadata provide the ability to specify generic
noalias memory-access sets. This means that some collection of memory access
instructions (loads, stores, memory-accessing calls, etc.) that carry
noalias
metadata can specifically be specified not to alias with some other
collection of memory access instructions that carry alias.scope
metadata.
Each type of metadata specifies a list of scopes where each scope has an id and
a domain.
When evaluating an aliasing query, if for some domain, the set
of scopes with that domain in one instruction’s alias.scope
list is a
subset of (or equal to) the set of scopes for that domain in another
instruction’s noalias
list, then the two memory accesses are assumed not to
alias.
Because scopes in one domain don’t affect scopes in other domains, separate domains can be used to compose multiple independent noalias sets. This is used for example during inlining. As the noalias function parameters are turned into noalias scope metadata, a new domain is used every time the function is inlined.
The metadata identifying each domain is itself a list containing one or two entries. The first entry is the name of the domain. Note that if the name is a string then it can be combined across functions and translation units. A self-reference can be used to create globally unique domain names. A descriptive string may optionally be provided as a second list entry.
The metadata identifying each scope is also itself a list containing two or three entries. The first entry is the name of the scope. Note that if the name is a string then it can be combined across functions and translation units. A self-reference can be used to create globally unique scope names. A metadata reference to the scope’s domain is the second entry. A descriptive string may optionally be provided as a third list entry.
For example,
; Two scope domains:
!0 = !{!0}
!1 = !{!1}
; Some scopes in these domains:
!2 = !{!2, !0}
!3 = !{!3, !0}
!4 = !{!4, !1}
; Some scope lists:
!5 = !{!4} ; A list containing only scope !4
!6 = !{!4, !3, !2}
!7 = !{!3}
; These two instructions don't alias:
%0 = load float, ptr %c, align 4, !alias.scope !5
store float %0, ptr %arrayidx.i, align 4, !noalias !5
; These two instructions also don't alias (for domain !1, the set of scopes
; in the !alias.scope equals that in the !noalias list):
%2 = load float, ptr %c, align 4, !alias.scope !5
store float %2, ptr %arrayidx.i2, align 4, !noalias !6
; These two instructions may alias (for domain !0, the set of scopes in
; the !noalias list is not a superset of, or equal to, the scopes in the
; !alias.scope list):
%2 = load float, ptr %c, align 4, !alias.scope !6
store float %0, ptr %arrayidx.i, align 4, !noalias !7
‘fpmath
’ Metadata¶
fpmath
metadata may be attached to any instruction of floating-point
type. It can be used to express the maximum acceptable error in the
result of that instruction, in ULPs, thus potentially allowing the
compiler to use a more efficient but less accurate method of computing
it. ULP is defined as follows:
If
x
is a real number that lies between two finite consecutive floating-point numbersa
andb
, without being equal to one of them, thenulp(x) = |b - a|
, otherwiseulp(x)
is the distance between the two non-equal finite floating-point numbers nearestx
. Moreover,ulp(NaN)
isNaN
.
The metadata node shall consist of a single positive float type number representing the maximum relative error, for example:
!0 = !{ float 2.5 } ; maximum acceptable inaccuracy is 2.5 ULPs
‘range
’ Metadata¶
range
metadata may be attached only to load
, call
and invoke
of
integer or vector of integer types. It expresses the possible ranges the loaded
value or the value returned by the called function at this call site is in. If
the loaded or returned value is not in the specified range, a poison value is
returned instead. The ranges are represented with a flattened list of integers.
The loaded value or the value returned is known to be in the union of the ranges
defined by each consecutive pair. Each pair has the following properties:
The type must match the scalar type of the instruction.
The pair
a,b
represents the range[a,b)
.Both
a
andb
are constants.The range is allowed to wrap.
The range should not represent the full or empty set. That is,
a!=b
.
In addition, the pairs must be in signed order of the lower bound and they must be non-contiguous.
For vector-typed instructions, the range is applied element-wise.
Examples:
%a = load i8, ptr %x, align 1, !range !0 ; Can only be 0 or 1
%b = load i8, ptr %y, align 1, !range !1 ; Can only be 255 (-1), 0 or 1
%c = call i8 @foo(), !range !2 ; Can only be 0, 1, 3, 4 or 5
%d = invoke i8 @bar() to label %cont
unwind label %lpad, !range !3 ; Can only be -2, -1, 3, 4 or 5
%e = load <2 x i8>, ptr %x, !range 0 ; Can only be <0 or 1, 0 or 1>
...
!0 = !{ i8 0, i8 2 }
!1 = !{ i8 255, i8 2 }
!2 = !{ i8 0, i8 2, i8 3, i8 6 }
!3 = !{ i8 -2, i8 0, i8 3, i8 6 }
‘absolute_symbol
’ Metadata¶
absolute_symbol
metadata may be attached to a global variable
declaration. It marks the declaration as a reference to an absolute symbol,
which causes the backend to use absolute relocations for the symbol even
in position independent code, and expresses the possible ranges that the
global variable’s address (not its value) is in, in the same format as
range
metadata, with the extension that the pair all-ones,all-ones
may be used to represent the full set.
Example (assuming 64-bit pointers):
@a = external global i8, !absolute_symbol !0 ; Absolute symbol in range [0,256)
@b = external global i8, !absolute_symbol !1 ; Absolute symbol in range [0,2^64)
...
!0 = !{ i64 0, i64 256 }
!1 = !{ i64 -1, i64 -1 }
‘callees
’ Metadata¶
callees
metadata may be attached to indirect call sites. If callees
metadata is attached to a call site, and any callee is not among the set of
functions provided by the metadata, the behavior is undefined. The intent of
this metadata is to facilitate optimizations such as indirect-call promotion.
For example, in the code below, the call instruction may only target the
add
or sub
functions:
%result = call i64 %binop(i64 %x, i64 %y), !callees !0
...
!0 = !{ptr @add, ptr @sub}
‘callback
’ Metadata¶
callback
metadata may be attached to a function declaration, or definition.
(Call sites are excluded only due to the lack of a use case.) For ease of
exposition, we’ll refer to the function annotated w/ metadata as a broker
function. The metadata describes how the arguments of a call to the broker are
in turn passed to the callback function specified by the metadata. Thus, the
callback
metadata provides a partial description of a call site inside the
broker function with regards to the arguments of a call to the broker. The only
semantic restriction on the broker function itself is that it is not allowed to
inspect or modify arguments referenced in the callback
metadata as
pass-through to the callback function.
The broker is not required to actually invoke the callback function at runtime. However, the assumptions about not inspecting or modifying arguments that would be passed to the specified callback function still hold, even if the callback function is not dynamically invoked. The broker is allowed to invoke the callback function more than once per invocation of the broker. The broker is also allowed to invoke (directly or indirectly) the function passed as a callback through another use. Finally, the broker is also allowed to relay the callback callee invocation to a different thread.
The metadata is structured as follows: At the outer level, callback
metadata is a list of callback
encodings. Each encoding starts with a
constant i64
which describes the argument position of the callback function
in the call to the broker. The following elements, except the last, describe
what arguments are passed to the callback function. Each element is again an
i64
constant identifying the argument of the broker that is passed through,
or i64 -1
to indicate an unknown or inspected argument. The order in which
they are listed has to be the same in which they are passed to the callback
callee. The last element of the encoding is a boolean which specifies how
variadic arguments of the broker are handled. If it is true, all variadic
arguments of the broker are passed through to the callback function after the
arguments encoded explicitly before.
In the code below, the pthread_create
function is marked as a broker
through the !callback !1
metadata. In the example, there is only one
callback encoding, namely !2
, associated with the broker. This encoding
identifies the callback function as the second argument of the broker (i64
2
) and the sole argument of the callback function as the third one of the
broker function (i64 3
).
declare !callback !1 dso_local i32 @pthread_create(ptr, ptr, ptr, ptr)
...
!2 = !{i64 2, i64 3, i1 false}
!1 = !{!2}
Another example is shown below. The callback callee is the second argument of
the __kmpc_fork_call
function (i64 2
). The callee is given two unknown
values (each identified by a i64 -1
) and afterwards all
variadic arguments that are passed to the __kmpc_fork_call
call (due to the
final i1 true
).
declare !callback !0 dso_local void @__kmpc_fork_call(ptr, i32, ptr, ...)
...
!1 = !{i64 2, i64 -1, i64 -1, i1 true}
!0 = !{!1}
‘exclude
’ Metadata¶
exclude
metadata may be attached to a global variable to signify that its
section should not be included in the final executable or shared library. This
option is only valid for global variables with an explicit section targeting ELF
or COFF. This is done using the SHF_EXCLUDE
flag on ELF targets and the
IMAGE_SCN_LNK_REMOVE
and IMAGE_SCN_MEM_DISCARDABLE
flags for COFF
targets. Additionally, this metadata is only used as a flag, so the associated
node must be empty. The explicit section should not conflict with any other
sections that the user does not want removed after linking.
@object = private constant [1 x i8] c"\00", section ".foo" !exclude !0
...
!0 = !{}
‘unpredictable
’ Metadata¶
unpredictable
metadata may be attached to any branch or switch
instruction. It can be used to express the unpredictability of control
flow. Similar to the llvm.expect intrinsic, it may be used to alter
optimizations related to compare and branch instructions. The metadata
is treated as a boolean value; if it exists, it signals that the branch
or switch that it is attached to is completely unpredictable.
‘dereferenceable
’ Metadata¶
The existence of the !dereferenceable
metadata on the instruction
tells the optimizer that the value loaded is known to be dereferenceable,
otherwise the behavior is undefined.
The number of bytes known to be dereferenceable is specified by the integer
value in the metadata node. This is analogous to the ‘’dereferenceable’’
attribute on parameters and return values.
‘dereferenceable_or_null
’ Metadata¶
The existence of the !dereferenceable_or_null
metadata on the
instruction tells the optimizer that the value loaded is known to be either
dereferenceable or null, otherwise the behavior is undefined.
The number of bytes known to be dereferenceable is specified by the integer
value in the metadata node. This is analogous to the ‘’dereferenceable_or_null’’
attribute on parameters and return values.
‘llvm.loop
’¶
It is sometimes useful to attach information to loop constructs. Currently,
loop metadata is implemented as metadata attached to the branch instruction
in the loop latch block. The loop metadata node is a list of
other metadata nodes, each representing a property of the loop. Usually,
the first item of the property node is a string. For example, the
llvm.loop.unroll.count
suggests an unroll factor to the loop
unroller:
br i1 %exitcond, label %._crit_edge, label %.lr.ph, !llvm.loop !0
...
!0 = !{!0, !1, !2}
!1 = !{!"llvm.loop.unroll.enable"}
!2 = !{!"llvm.loop.unroll.count", i32 4}
For legacy reasons, the first item of a loop metadata node must be a reference to itself. Before the advent of the ‘distinct’ keyword, this forced the preservation of otherwise identical metadata nodes. Since the loop-metadata node can be attached to multiple nodes, the ‘distinct’ keyword has become unnecessary.
Prior to the property nodes, one or two DILocation
(debug location)
nodes can be present in the list. The first, if present, identifies the
source-code location where the loop begins. The second, if present,
identifies the source-code location where the loop ends.
Loop metadata nodes cannot be used as unique identifiers. They are neither persistent for the same loop through transformations nor necessarily unique to just one loop.
‘llvm.loop.disable_nonforced
’¶
This metadata disables all optional loop transformations unless
explicitly instructed using other transformation metadata such as
llvm.loop.unroll.enable
. That is, no heuristic will try to determine
whether a transformation is profitable. The purpose is to avoid that the
loop is transformed to a different loop before an explicitly requested
(forced) transformation is applied. For instance, loop fusion can make
other transformations impossible. Mandatory loop canonicalizations such
as loop rotation are still applied.
It is recommended to use this metadata in addition to any llvm.loop.* transformation directive. Also, any loop should have at most one directive applied to it (and a sequence of transformations built using followup-attributes). Otherwise, which transformation will be applied depends on implementation details such as the pass pipeline order.
See Code Transformation Metadata for details.
‘llvm.loop.vectorize
’ and ‘llvm.loop.interleave
’¶
Metadata prefixed with llvm.loop.vectorize
or llvm.loop.interleave
are
used to control per-loop vectorization and interleaving parameters such as
vectorization width and interleave count. These metadata should be used in
conjunction with llvm.loop
loop identification metadata. The
llvm.loop.vectorize
and llvm.loop.interleave
metadata are only
optimization hints and the optimizer will only interleave and vectorize loops if
it believes it is safe to do so. The llvm.loop.parallel_accesses
metadata
which contains information about loop-carried memory dependencies can be helpful
in determining the safety of these transformations.
‘llvm.loop.interleave.count
’ Metadata¶
This metadata suggests an interleave count to the loop interleaver.
The first operand is the string llvm.loop.interleave.count
and the
second operand is an integer specifying the interleave count. For
example:
!0 = !{!"llvm.loop.interleave.count", i32 4}
Note that setting llvm.loop.interleave.count
to 1 disables interleaving
multiple iterations of the loop. If llvm.loop.interleave.count
is set to 0
then the interleave count will be determined automatically.
‘llvm.loop.vectorize.enable
’ Metadata¶
This metadata selectively enables or disables vectorization for the loop. The
first operand is the string llvm.loop.vectorize.enable
and the second operand
is a bit. If the bit operand value is 1 vectorization is enabled. A value of
0 disables vectorization:
!0 = !{!"llvm.loop.vectorize.enable", i1 0}
!1 = !{!"llvm.loop.vectorize.enable", i1 1}
‘llvm.loop.vectorize.predicate.enable
’ Metadata¶
This metadata selectively enables or disables creating predicated instructions
for the loop, which can enable folding of the scalar epilogue loop into the
main loop. The first operand is the string
llvm.loop.vectorize.predicate.enable
and the second operand is a bit. If
the bit operand value is 1 vectorization is enabled. A value of 0 disables
vectorization:
!0 = !{!"llvm.loop.vectorize.predicate.enable", i1 0}
!1 = !{!"llvm.loop.vectorize.predicate.enable", i1 1}
‘llvm.loop.vectorize.scalable.enable
’ Metadata¶
This metadata selectively enables or disables scalable vectorization for the
loop, and only has any effect if vectorization for the loop is already enabled.
The first operand is the string llvm.loop.vectorize.scalable.enable
and the second operand is a bit. If the bit operand value is 1 scalable
vectorization is enabled, whereas a value of 0 reverts to the default fixed
width vectorization:
!0 = !{!"llvm.loop.vectorize.scalable.enable", i1 0}
!1 = !{!"llvm.loop.vectorize.scalable.enable", i1 1}
‘llvm.loop.vectorize.width
’ Metadata¶
This metadata sets the target width of the vectorizer. The first
operand is the string llvm.loop.vectorize.width
and the second
operand is an integer specifying the width. For example:
!0 = !{!"llvm.loop.vectorize.width", i32 4}
Note that setting llvm.loop.vectorize.width
to 1 disables
vectorization of the loop. If llvm.loop.vectorize.width
is set to
0 or if the loop does not have this metadata the width will be
determined automatically.
‘llvm.loop.vectorize.followup_vectorized
’ Metadata¶
This metadata defines which loop attributes the vectorized loop will have. See Code Transformation Metadata for details.
‘llvm.loop.vectorize.followup_epilogue
’ Metadata¶
This metadata defines which loop attributes the epilogue will have. The epilogue is not vectorized and is executed when either the vectorized loop is not known to preserve semantics (because e.g., it processes two arrays that are found to alias by a runtime check) or for the last iterations that do not fill a complete set of vector lanes. See Transformation Metadata for details.
‘llvm.loop.vectorize.followup_all
’ Metadata¶
Attributes in the metadata will be added to both the vectorized and epilogue loop. See Transformation Metadata for details.
‘llvm.loop.unroll
’¶
Metadata prefixed with llvm.loop.unroll
are loop unrolling
optimization hints such as the unroll factor. llvm.loop.unroll
metadata should be used in conjunction with llvm.loop
loop
identification metadata. The llvm.loop.unroll
metadata are only
optimization hints and the unrolling will only be performed if the
optimizer believes it is safe to do so.
‘llvm.loop.unroll.count
’ Metadata¶
This metadata suggests an unroll factor to the loop unroller. The
first operand is the string llvm.loop.unroll.count
and the second
operand is a positive integer specifying the unroll factor. For
example:
!0 = !{!"llvm.loop.unroll.count", i32 4}
If the trip count of the loop is less than the unroll count the loop will be partially unrolled.
‘llvm.loop.unroll.disable
’ Metadata¶
This metadata disables loop unrolling. The metadata has a single operand
which is the string llvm.loop.unroll.disable
. For example:
!0 = !{!"llvm.loop.unroll.disable"}
‘llvm.loop.unroll.runtime.disable
’ Metadata¶
This metadata disables runtime loop unrolling. The metadata has a single
operand which is the string llvm.loop.unroll.runtime.disable
. For example:
!0 = !{!"llvm.loop.unroll.runtime.disable"}
‘llvm.loop.unroll.enable
’ Metadata¶
This metadata suggests that the loop should be fully unrolled if the trip count
is known at compile time and partially unrolled if the trip count is not known
at compile time. The metadata has a single operand which is the string
llvm.loop.unroll.enable
. For example:
!0 = !{!"llvm.loop.unroll.enable"}
‘llvm.loop.unroll.full
’ Metadata¶
This metadata suggests that the loop should be unrolled fully. The
metadata has a single operand which is the string llvm.loop.unroll.full
.
For example:
!0 = !{!"llvm.loop.unroll.full"}
‘llvm.loop.unroll.followup
’ Metadata¶
This metadata defines which loop attributes the unrolled loop will have. See Transformation Metadata for details.
‘llvm.loop.unroll.followup_remainder
’ Metadata¶
This metadata defines which loop attributes the remainder loop after partial/runtime unrolling will have. See Transformation Metadata for details.
‘llvm.loop.unroll_and_jam
’¶
This metadata is treated very similarly to the llvm.loop.unroll
metadata
above, but affect the unroll and jam pass. In addition any loop with
llvm.loop.unroll
metadata but no llvm.loop.unroll_and_jam
metadata will
disable unroll and jam (so llvm.loop.unroll
metadata will be left to the
unroller, plus llvm.loop.unroll.disable
metadata will disable unroll and jam
too.)
The metadata for unroll and jam otherwise is the same as for unroll
.
llvm.loop.unroll_and_jam.enable
, llvm.loop.unroll_and_jam.disable
and
llvm.loop.unroll_and_jam.count
do the same as for unroll.
llvm.loop.unroll_and_jam.full
is not supported. Again these are only hints
and the normal safety checks will still be performed.
‘llvm.loop.unroll_and_jam.count
’ Metadata¶
This metadata suggests an unroll and jam factor to use, similarly to
llvm.loop.unroll.count
. The first operand is the string
llvm.loop.unroll_and_jam.count
and the second operand is a positive integer
specifying the unroll factor. For example:
!0 = !{!"llvm.loop.unroll_and_jam.count", i32 4}
If the trip count of the loop is less than the unroll count the loop will be partially unroll and jammed.
‘llvm.loop.unroll_and_jam.disable
’ Metadata¶
This metadata disables loop unroll and jamming. The metadata has a single
operand which is the string llvm.loop.unroll_and_jam.disable
. For example:
!0 = !{!"llvm.loop.unroll_and_jam.disable"}
‘llvm.loop.unroll_and_jam.enable
’ Metadata¶
This metadata suggests that the loop should be fully unroll and jammed if the
trip count is known at compile time and partially unrolled if the trip count is
not known at compile time. The metadata has a single operand which is the
string llvm.loop.unroll_and_jam.enable
. For example:
!0 = !{!"llvm.loop.unroll_and_jam.enable"}
‘llvm.loop.unroll_and_jam.followup_outer
’ Metadata¶
This metadata defines which loop attributes the outer unrolled loop will have. See Transformation Metadata for details.
‘llvm.loop.unroll_and_jam.followup_inner
’ Metadata¶
This metadata defines which loop attributes the inner jammed loop will have. See Transformation Metadata for details.
‘llvm.loop.unroll_and_jam.followup_remainder_outer
’ Metadata¶
This metadata defines which attributes the epilogue of the outer loop will have. This loop is usually unrolled, meaning there is no such loop. This attribute will be ignored in this case. See Transformation Metadata for details.
‘llvm.loop.unroll_and_jam.followup_remainder_inner
’ Metadata¶
This metadata defines which attributes the inner loop of the epilogue will have. The outer epilogue will usually be unrolled, meaning there can be multiple inner remainder loops. See Transformation Metadata for details.
‘llvm.loop.unroll_and_jam.followup_all
’ Metadata¶
Attributes specified in the metadata is added to all
llvm.loop.unroll_and_jam.*
loops. See
Transformation Metadata for details.
‘llvm.loop.licm_versioning.disable
’ Metadata¶
This metadata indicates that the loop should not be versioned for the purpose
of enabling loop-invariant code motion (LICM). The metadata has a single operand
which is the string llvm.loop.licm_versioning.disable
. For example:
!0 = !{!"llvm.loop.licm_versioning.disable"}
‘llvm.loop.distribute.enable
’ Metadata¶
Loop distribution allows splitting a loop into multiple loops. Currently, this is only performed if the entire loop cannot be vectorized due to unsafe memory dependencies. The transformation will attempt to isolate the unsafe dependencies into their own loop.
This metadata can be used to selectively enable or disable distribution of the
loop. The first operand is the string llvm.loop.distribute.enable
and the
second operand is a bit. If the bit operand value is 1 distribution is
enabled. A value of 0 disables distribution:
!0 = !{!"llvm.loop.distribute.enable", i1 0}
!1 = !{!"llvm.loop.distribute.enable", i1 1}
This metadata should be used in conjunction with llvm.loop
loop
identification metadata.
‘llvm.loop.distribute.followup_coincident
’ Metadata¶
This metadata defines which attributes extracted loops with no cyclic dependencies will have (i.e. can be vectorized). See Transformation Metadata for details.
‘llvm.loop.distribute.followup_sequential
’ Metadata¶
This metadata defines which attributes the isolated loops with unsafe memory dependencies will have. See Transformation Metadata for details.
‘llvm.loop.distribute.followup_fallback
’ Metadata¶
If loop versioning is necessary, this metadata defined the attributes the non-distributed fallback version will have. See Transformation Metadata for details.
‘llvm.loop.distribute.followup_all
’ Metadata¶
The attributes in this metadata is added to all followup loops of the loop distribution pass. See Transformation Metadata for details.
‘llvm.licm.disable
’ Metadata¶
This metadata indicates that loop-invariant code motion (LICM) should not be
performed on this loop. The metadata has a single operand which is the string
llvm.licm.disable
. For example:
!0 = !{!"llvm.licm.disable"}
Note that although it operates per loop it isn’t given the llvm.loop prefix
as it is not affected by the llvm.loop.disable_nonforced
metadata.
‘llvm.access.group
’ Metadata¶
llvm.access.group
metadata can be attached to any instruction that
potentially accesses memory. It can point to a single distinct metadata
node, which we call access group. This node represents all memory access
instructions referring to it via llvm.access.group
. When an
instruction belongs to multiple access groups, it can also point to a
list of accesses groups, illustrated by the following example.
%val = load i32, ptr %arrayidx, !llvm.access.group !0
...
!0 = !{!1, !2}
!1 = distinct !{}
!2 = distinct !{}
It is illegal for the list node to be empty since it might be confused with an access group.
The access group metadata node must be ‘distinct’ to avoid collapsing multiple access groups by content. An access group metadata node must always be empty which can be used to distinguish an access group metadata node from a list of access groups. Being empty avoids the situation that the content must be updated which, because metadata is immutable by design, would required finding and updating all references to the access group node.
The access group can be used to refer to a memory access instruction
without pointing to it directly (which is not possible in global
metadata). Currently, the only metadata making use of it is
llvm.loop.parallel_accesses
.
‘llvm.loop.parallel_accesses
’ Metadata¶
The llvm.loop.parallel_accesses
metadata refers to one or more
access group metadata nodes (see llvm.access.group
). It denotes that
no loop-carried memory dependence exist between it and other instructions
in the loop with this metadata.
Let m1
and m2
be two instructions that both have the
llvm.access.group
metadata to the access group g1
, respectively
g2
(which might be identical). If a loop contains both access groups
in its llvm.loop.parallel_accesses
metadata, then the compiler can
assume that there is no dependency between m1
and m2
carried by
this loop. Instructions that belong to multiple access groups are
considered having this property if at least one of the access groups
matches the llvm.loop.parallel_accesses
list.
If all memory-accessing instructions in a loop have
llvm.access.group
metadata that each refer to one of the access
groups of a loop’s llvm.loop.parallel_accesses
metadata, then the
loop has no loop carried memory dependences and is considered to be a
parallel loop.
Note that if not all memory access instructions belong to an access
group referred to by llvm.loop.parallel_accesses
, then the loop must
not be considered trivially parallel. Additional
memory dependence analysis is required to make that determination. As a fail
safe mechanism, this causes loops that were originally parallel to be considered
sequential (if optimization passes that are unaware of the parallel semantics
insert new memory instructions into the loop body).
Example of a loop that is considered parallel due to its correct use of
both llvm.access.group
and llvm.loop.parallel_accesses
metadata types.
for.body:
...
%val0 = load i32, ptr %arrayidx, !llvm.access.group !1
...
store i32 %val0, ptr %arrayidx1, !llvm.access.group !1
...
br i1 %exitcond, label %for.end, label %for.body, !llvm.loop !0
for.end:
...
!0 = distinct !{!0, !{!"llvm.loop.parallel_accesses", !1}}
!1 = distinct !{}
It is also possible to have nested parallel loops:
outer.for.body:
...
%val1 = load i32, ptr %arrayidx3, !llvm.access.group !4
...
br label %inner.for.body
inner.for.body:
...
%val0 = load i32, ptr %arrayidx1, !llvm.access.group !3
...
store i32 %val0, ptr %arrayidx2, !llvm.access.group !3
...
br i1 %exitcond, label %inner.for.end, label %inner.for.body, !llvm.loop !1
inner.for.end:
...
store i32 %val1, ptr %arrayidx4, !llvm.access.group !4
...
br i1 %exitcond, label %outer.for.end, label %outer.for.body, !llvm.loop !2
outer.for.end: ; preds = %for.body
...
!1 = distinct !{!1, !{!"llvm.loop.parallel_accesses", !3}} ; metadata for the inner loop
!2 = distinct !{!2, !{!"llvm.loop.parallel_accesses", !3, !4}} ; metadata for the outer loop
!3 = distinct !{} ; access group for instructions in the inner loop (which are implicitly contained in outer loop as well)
!4 = distinct !{} ; access group for instructions in the outer, but not the inner loop
‘llvm.loop.mustprogress
’ Metadata¶
The llvm.loop.mustprogress
metadata indicates that this loop is required to
terminate, unwind, or interact with the environment in an observable way e.g.
via a volatile memory access, I/O, or other synchronization. If such a loop is
not found to interact with the environment in an observable way, the loop may
be removed. This corresponds to the mustprogress
function attribute.
‘irr_loop
’ Metadata¶
irr_loop
metadata may be attached to the terminator instruction of a basic
block that’s an irreducible loop header (note that an irreducible loop has more
than once header basic blocks.) If irr_loop
metadata is attached to the
terminator instruction of a basic block that is not really an irreducible loop
header, the behavior is undefined. The intent of this metadata is to improve the
accuracy of the block frequency propagation. For example, in the code below, the
block header0
may have a loop header weight (relative to the other headers of
the irreducible loop) of 100:
header0:
...
br i1 %cmp, label %t1, label %t2, !irr_loop !0
...
!0 = !{"loop_header_weight", i64 100}
Irreducible loop header weights are typically based on profile data.
‘invariant.group
’ Metadata¶
The experimental invariant.group
metadata may be attached to
load
/store
instructions referencing a single metadata with no entries.
The existence of the invariant.group
metadata on the instruction tells
the optimizer that every load
and store
to the same pointer operand
can be assumed to load or store the same
value (but see the llvm.launder.invariant.group
intrinsic which affects
when two pointers are considered the same). Pointers returned by bitcast or
getelementptr with only zero indices are considered the same.
Examples:
@unknownPtr = external global i8
...
%ptr = alloca i8
store i8 42, ptr %ptr, !invariant.group !0
call void @foo(ptr %ptr)
%a = load i8, ptr %ptr, !invariant.group !0 ; Can assume that value under %ptr didn't change
call void @foo(ptr %ptr)
%newPtr = call ptr @getPointer(ptr %ptr)
%c = load i8, ptr %newPtr, !invariant.group !0 ; Can't assume anything, because we only have information about %ptr
%unknownValue = load i8, ptr @unknownPtr
store i8 %unknownValue, ptr %ptr, !invariant.group !0 ; Can assume that %unknownValue == 42
call void @foo(ptr %ptr)
%newPtr2 = call ptr @llvm.launder.invariant.group.p0(ptr %ptr)
%d = load i8, ptr %newPtr2, !invariant.group !0 ; Can't step through launder.invariant.group to get value of %ptr
...
declare void @foo(ptr)
declare ptr @getPointer(ptr)
declare ptr @llvm.launder.invariant.group.p0(ptr)
!0 = !{}
The invariant.group metadata must be dropped when replacing one pointer by another based on aliasing information. This is because invariant.group is tied to the SSA value of the pointer operand.
%v = load i8, ptr %x, !invariant.group !0
; if %x mustalias %y then we can replace the above instruction with
%v = load i8, ptr %y
Note that this is an experimental feature, which means that its semantics might change in the future.
‘type
’ Metadata¶
See Type Metadata.
‘associated
’ Metadata¶
The associated
metadata may be attached to a global variable definition with
a single argument that references a global object (optionally through an alias).
This metadata lowers to the ELF section flag SHF_LINK_ORDER
which prevents
discarding of the global variable in linker GC unless the referenced object is
also discarded. The linker support for this feature is spotty. For best
compatibility, globals carrying this metadata should:
Be in
@llvm.compiler.used
.If the referenced global variable is in a comdat, be in the same comdat.
!associated
can not express many-to-one relationship. A global variable with
the metadata should generally not be referenced by a function: the function may
be inlined into other functions, leading to more references to the metadata.
Ideally we would want to keep metadata alive as long as any inline location is
alive, but this many-to-one relationship is not representable. Moreover, if the
metadata is retained while the function is discarded, the linker will report an
error of a relocation referencing a discarded section.
The metadata is often used with an explicit section consisting of valid C
identifiers so that the runtime can find the metadata section with
linker-defined encapsulation symbols __start_<section_name>
and
__stop_<section_name>
.
It does not have any effect on non-ELF targets.
Example:
$a = comdat any
@a = global i32 1, comdat $a
@b = internal global i32 2, comdat $a, section "abc", !associated !0
!0 = !{ptr @a}
‘prof
’ Metadata¶
The prof
metadata is used to record profile data in the IR.
The first operand of the metadata node indicates the profile metadata
type. There are currently 3 types:
branch_weights,
function_entry_count, and
VP.
branch_weights¶
Branch weight metadata attached to a branch, select, switch or call instruction represents the likeliness of the associated branch being taken. For more information, see LLVM Branch Weight Metadata.
function_entry_count¶
Function entry count metadata can be attached to function definitions to record the number of times the function is called. Used with BFI information, it is also used to derive the basic block profile count. For more information, see LLVM Branch Weight Metadata.
VP¶
VP (value profile) metadata can be attached to instructions that have value profile information. Currently this is indirect calls (where it records the hottest callees) and calls to memory intrinsics such as memcpy, memmove, and memset (where it records the hottest byte lengths).
Each VP metadata node contains “VP” string, then a uint32_t value for the value profiling kind, a uint64_t value for the total number of times the instruction is executed, followed by uint64_t value and execution count pairs. The value profiling kind is 0 for indirect call targets and 1 for memory operations. For indirect call targets, each profile value is a hash of the callee function name, and for memory operations each value is the byte length.
Note that the value counts do not need to add up to the total count listed in the third operand (in practice only the top hottest values are tracked and reported).
Indirect call example:
call void %f(), !prof !1
!1 = !{!"VP", i32 0, i64 1600, i64 7651369219802541373, i64 1030, i64 -4377547752858689819, i64 410}
Note that the VP type is 0 (the second operand), which indicates this is an indirect call value profile data. The third operand indicates that the indirect call executed 1600 times. The 4th and 6th operands give the hashes of the 2 hottest target functions’ names (this is the same hash used to represent function names in the profile database), and the 5th and 7th operands give the execution count that each of the respective prior target functions was called.
‘annotation
’ Metadata¶
The annotation
metadata can be used to attach a tuple of annotation strings
or a tuple of a tuple of annotation strings to any instruction. This metadata does
not impact the semantics of the program and may only be used to provide additional
insight about the program and transformations to users.
Example:
%a.addr = alloca ptr, align 8, !annotation !0
!0 = !{!"auto-init"}
Embedding tuple of strings example:
%a.ptr = getelementptr ptr, ptr %base, i64 0. !annotation !0
!0 = !{!1}
!1 = !{!"gep offset", !"0"}
‘func_sanitize
’ Metadata¶
The func_sanitize
metadata is used to attach two values for the function
sanitizer instrumentation. The first value is the ubsan function signature.
The second value is the address of the proxy variable which stores the address
of the RTTI descriptor. If prologue and ‘func_sanitize
’
are used at the same time, prologue is emitted before
‘func_sanitize
’ in the output.
Example:
@__llvm_rtti_proxy = private unnamed_addr constant ptr @_ZTIFvvE
define void @_Z3funv() !func_sanitize !0 {
return void
}
!0 = !{i32 846595819, ptr @__llvm_rtti_proxy}
‘kcfi_type
’ Metadata¶
The kcfi_type
metadata can be used to attach a type identifier to
functions that can be called indirectly. The type data is emitted before the
function entry in the assembly. Indirect calls with the kcfi operand
bundle will emit a check that compares the type identifier to the
metadata.
Example:
define dso_local i32 @f() !kcfi_type !0 {
ret i32 0
}
!0 = !{i32 12345678}
Clang emits kcfi_type
metadata nodes for address-taken functions with
-fsanitize=kcfi
.
‘memprof
’ Metadata¶
The memprof
metadata is used to record memory profile data on heap
allocation calls. Multiple context-sensitive profiles can be represented
with a single memprof
metadata attachment.
Example:
%call = call ptr @_Znam(i64 10), !memprof !0, !callsite !5
!0 = !{!1, !3}
!1 = !{!2, !"cold"}
!2 = !{i64 4854880825882961848, i64 1905834578520680781}
!3 = !{!4, !"notcold"}
!4 = !{i64 4854880825882961848, i64 -6528110295079665978}
!5 = !{i64 4854880825882961848}
Each operand in the memprof
metadata attachment describes the profiled
behavior of memory allocated by the associated allocation for a given context.
In the above example, there were 2 profiled contexts, one allocating memory
that was typically cold and one allocating memory that was typically not cold.
The format of the metadata describing a context specific profile (e.g.
!1
and !3
above) requires a first operand that is a metadata node
describing the context, followed by a list of string metadata tags describing
the profile behavior (e.g. cold
and notcold
) above. The metadata nodes
describing the context (e.g. !2
and !4
above) are unique ids
corresponding to callsites, which can be matched to associated IR calls via
callsite metadata. In practice these ids are formed via
a hash of the callsite’s debug info, and the associated call may be in a
different module. The contexts are listed in order from leaf-most call (the
allocation itself) to the outermost callsite context required for uniquely
identifying the described profile behavior (note this may not be the top of
the profiled call stack).
‘callsite
’ Metadata¶
The callsite
metadata is used to identify callsites involved in memory
profile contexts described in memprof metadata.
It is attached both to the profile allocation calls (see the example in
memprof metadata), as well as to other callsites
in profiled contexts described in heap allocation memprof
metadata.
Example:
%call = call ptr @_Z1Bb(void), !callsite !0
!0 = !{i64 -6528110295079665978, i64 5462047985461644151}
Each operand in the callsite
metadata attachment is a unique id
corresponding to a callsite (possibly inlined). In practice these ids are
formed via a hash of the callsite’s debug info. If the call was not inlined
into any callers it will contain a single operand (id). If it was inlined
it will contain a list of ids, including the ids of the callsites in the
full inline sequence, in order from the leaf-most call’s id to the outermost
inlined call.
Module Flags Metadata¶
Information about the module as a whole is difficult to convey to LLVM’s
subsystems. The LLVM IR isn’t sufficient to transmit this information.
The llvm.module.flags
named metadata exists in order to facilitate
this. These flags are in the form of key / value pairs — much like a
dictionary — making it easy for any subsystem who cares about a flag to
look it up.
The llvm.module.flags
metadata contains a list of metadata triplets.
Each triplet has the following form:
The first element is a behavior flag, which specifies the behavior when two (or more) modules are merged together, and it encounters two (or more) metadata with the same ID. The supported behaviors are described below.
The second element is a metadata string that is a unique ID for the metadata. Each module may only have one flag entry for each unique ID (not including entries with the Require behavior).
The third element is the value of the flag.
When two (or more) modules are merged together, the resulting
llvm.module.flags
metadata is the union of the modules’ flags. That is, for
each unique metadata ID string, there will be exactly one entry in the merged
modules llvm.module.flags
metadata table, and the value for that entry will
be determined by the merge behavior flag, as described below. The only exception
is that entries with the Require behavior are always preserved.
The following behaviors are supported:
Value |
Behavior |
---|---|
1 |
|
2 |
|
3 |
|
4 |
|
5 |
|
6 |
|
7 |
|
8 |
|
It is an error for a particular unique flag ID to have multiple behaviors, except in the case of Require (which adds restrictions on another metadata value) or Override.
An example of module flags:
!0 = !{ i32 1, !"foo", i32 1 }
!1 = !{ i32 4, !"bar", i32 37 }
!2 = !{ i32 2, !"qux", i32 42 }
!3 = !{ i32 3, !"qux",
!{
!"foo", i32 1
}
}
!llvm.module.flags = !{ !0, !1, !2, !3 }
Metadata
!0
has the ID!"foo"
and the value ‘1’. The behavior if two or more!"foo"
flags are seen is to emit an error if their values are not equal.Metadata
!1
has the ID!"bar"
and the value ‘37’. The behavior if two or more!"bar"
flags are seen is to use the value ‘37’.Metadata
!2
has the ID!"qux"
and the value ‘42’. The behavior if two or more!"qux"
flags are seen is to emit a warning if their values are not equal.Metadata
!3
has the ID!"qux"
and the value:!{ !"foo", i32 1 }
The behavior is to emit an error if the
llvm.module.flags
does not contain a flag with the ID!"foo"
that has the value ‘1’ after linking is performed.
Synthesized Functions Module Flags Metadata¶
These metadata specify the default attributes synthesized functions should have. These metadata are currently respected by a few instrumentation passes, such as sanitizers.
These metadata correspond to a few function attributes with significant code generation behaviors. Function attributes with just optimization purposes should not be listed because the performance impact of these synthesized functions is small.
“frame-pointer”: Max. The value can be 0, 1, or 2. A synthesized function will get the “frame-pointer” function attribute, with value being “none”, “non-leaf”, or “all”, respectively.
“function_return_thunk_extern”: The synthesized function will get the
fn_return_thunk_extern
function attribute.“uwtable”: Max. The value can be 0, 1, or 2. If the value is 1, a synthesized function will get the
uwtable(sync)
function attribute, if the value is 2, a synthesized function will get theuwtable(async)
function attribute.
Objective-C Garbage Collection Module Flags Metadata¶
On the Mach-O platform, Objective-C stores metadata about garbage collection in a special section called “image info”. The metadata consists of a version number and a bitmask specifying what types of garbage collection are supported (if any) by the file. If two or more modules are linked together their garbage collection metadata needs to be merged rather than appended together.
The Objective-C garbage collection module flags metadata consists of the following key-value pairs:
Key |
Value |
---|---|
|
[Required] — The Objective-C ABI version. Valid values are 1 and 2. |
|
[Required] — The version of the image info section. Currently always 0. |
|
[Required] — The section to place the metadata. Valid values are
|
|
[Required] — Specifies whether garbage collection is supported or not. Valid values are 0, for no garbage collection, and 2, for garbage collection supported. |
|
[Optional] — Specifies that only garbage collection is supported.
If present, its value must be 6. This flag requires that the
|
Some important flag interactions:
If a module with
Objective-C Garbage Collection
set to 0 is merged with a module withObjective-C Garbage Collection
set to 2, then the resulting module has theObjective-C Garbage Collection
flag set to 0.A module with
Objective-C Garbage Collection
set to 0 cannot be merged with a module withObjective-C GC Only
set to 6.
C type width Module Flags Metadata¶
The ARM backend emits a section into each generated object file describing the options that it was compiled with (in a compiler-independent way) to prevent linking incompatible objects, and to allow automatic library selection. Some of these options are not visible at the IR level, namely wchar_t width and enum width.
To pass this information to the backend, these options are encoded in module flags metadata, using the following key-value pairs:
Key |
Value |
---|---|
short_wchar |
|
short_enum |
|
For example, the following metadata section specifies that the module was
compiled with a wchar_t
width of 4 bytes, and the underlying type of an
enum is the smallest type which can represent all of its values:
!llvm.module.flags = !{!0, !1}
!0 = !{i32 1, !"short_wchar", i32 1}
!1 = !{i32 1, !"short_enum", i32 0}
Stack Alignment Metadata¶
Changes the default stack alignment from the target ABI’s implicit default stack alignment. Takes an i32 value in bytes. It is considered an error to link two modules together with different values for this metadata.
For example:
!llvm.module.flags = !{!0} !0 = !{i32 1, !”override-stack-alignment”, i32 8}
This will change the stack alignment to 8B.
Embedded Objects Names Metadata¶
Offloading compilations need to embed device code into the host section table to create a fat binary. This metadata node references each global that will be embedded in the module. The primary use for this is to make referencing these globals more efficient in the IR. The metadata references nodes containing pointers to the global to be embedded followed by the section name it will be stored at:
!llvm.embedded.objects = !{!0}
!0 = !{ptr @object, !".section"}
Automatic Linker Flags Named Metadata¶
Some targets support embedding of flags to the linker inside individual object files. Typically this is used in conjunction with language extensions which allow source files to contain linker command line options, and have these automatically be transmitted to the linker via object files.
These flags are encoded in the IR using named metadata with the name
!llvm.linker.options
. Each operand is expected to be a metadata node
which should be a list of other metadata nodes, each of which should be a
list of metadata strings defining linker options.
For example, the following metadata section specifies two separate sets of
linker options, presumably to link against libz
and the Cocoa
framework:
!0 = !{ !"-lz" }
!1 = !{ !"-framework", !"Cocoa" }
!llvm.linker.options = !{ !0, !1 }
The metadata encoding as lists of lists of options, as opposed to a collapsed list of options, is chosen so that the IR encoding can use multiple option strings to specify e.g., a single library, while still having that specifier be preserved as an atomic element that can be recognized by a target specific assembly writer or object file emitter.
Each individual option is required to be either a valid option for the target’s linker, or an option that is reserved by the target specific assembly writer or object file emitter. No other aspect of these options is defined by the IR.
Dependent Libs Named Metadata¶
Some targets support embedding of strings into object files to indicate a set of libraries to add to the link. Typically this is used in conjunction with language extensions which allow source files to explicitly declare the libraries they depend on, and have these automatically be transmitted to the linker via object files.
The list is encoded in the IR using named metadata with the name
!llvm.dependent-libraries
. Each operand is expected to be a metadata node
which should contain a single string operand.
For example, the following metadata section contains two library specifiers:
!0 = !{!"a library specifier"}
!1 = !{!"another library specifier"}
!llvm.dependent-libraries = !{ !0, !1 }
Each library specifier will be handled independently by the consuming linker. The effect of the library specifiers are defined by the consuming linker.
ThinLTO Summary¶
Compiling with ThinLTO
causes the building of a compact summary of the module that is emitted into
the bitcode. The summary is emitted into the LLVM assembly and identified
in syntax by a caret (’^
’).
The summary is parsed into a bitcode output, along with the Module
IR, via the “llvm-as
” tool. Tools that parse the Module IR for the purposes
of optimization (e.g. “clang -x ir
” and “opt
”), will ignore the
summary entries (just as they currently ignore summary entries in a bitcode
input file).
Eventually, the summary will be parsed into a ModuleSummaryIndex object under
the same conditions where summary index is currently built from bitcode.
Specifically, tools that test the Thin Link portion of a ThinLTO compile
(i.e. llvm-lto and llvm-lto2), or when parsing a combined index
for a distributed ThinLTO backend via clang’s “-fthinlto-index=<>
” flag
(this part is not yet implemented, use llvm-as to create a bitcode object
before feeding into thin link tools for now).
There are currently 3 types of summary entries in the LLVM assembly: module paths, global values, and type identifiers.
Module Path Summary Entry¶
Each module path summary entry lists a module containing global values included in the summary. For a single IR module there will be one such entry, but in a combined summary index produced during the thin link, there will be one module path entry per linked module with summary.
Example:
^0 = module: (path: "/path/to/file.o", hash: (2468601609, 1329373163, 1565878005, 638838075, 3148790418))
The path
field is a string path to the bitcode file, and the hash
field is the 160-bit SHA-1 hash of the IR bitcode contents, used for
incremental builds and caching.
Global Value Summary Entry¶
Each global value summary entry corresponds to a global value defined or referenced by a summarized module.
Example:
^4 = gv: (name: "f"[, summaries: (Summary)[, (Summary)]*]?) ; guid = 14740650423002898831
For declarations, there will not be a summary list. For definitions, a global value will contain a list of summaries, one per module containing a definition. There can be multiple entries in a combined summary index for symbols with weak linkage.
Each Summary
format will depend on whether the global value is a
function, variable, or
alias.
Function Summary¶
If the global value is a function, the Summary
entry will look like:
function: (module: ^0, flags: (linkage: external, notEligibleToImport: 0, live: 0, dsoLocal: 0), insts: 2[, FuncFlags]?[, Calls]?[, TypeIdInfo]?[, Params]?[, Refs]?
The module
field includes the summary entry id for the module containing
this definition, and the flags
field contains information such as
the linkage type, a flag indicating whether it is legal to import the
definition, whether it is globally live and whether the linker resolved it
to a local definition (the latter two are populated during the thin link).
The insts
field contains the number of IR instructions in the function.
Finally, there are several optional fields: FuncFlags,
Calls, TypeIdInfo,
Params, Refs.
Global Variable Summary¶
If the global value is a variable, the Summary
entry will look like:
variable: (module: ^0, flags: (linkage: external, notEligibleToImport: 0, live: 0, dsoLocal: 0)[, Refs]?
The variable entry contains a subset of the fields in a function summary, see the descriptions there.
Alias Summary¶
If the global value is an alias, the Summary
entry will look like:
alias: (module: ^0, flags: (linkage: external, notEligibleToImport: 0, live: 0, dsoLocal: 0), aliasee: ^2)
The module
and flags
fields are as described for a
function summary. The aliasee
field
contains a reference to the global value summary entry of the aliasee.
Function Flags¶
The optional FuncFlags
field looks like:
funcFlags: (readNone: 0, readOnly: 0, noRecurse: 0, returnDoesNotAlias: 0, noInline: 0, alwaysInline: 0, noUnwind: 1, mayThrow: 0, hasUnknownCall: 0)
If unspecified, flags are assumed to hold the conservative false
value of
0
.
Calls¶
The optional Calls
field looks like:
calls: ((Callee)[, (Callee)]*)
where each Callee
looks like:
callee: ^1[, hotness: None]?[, relbf: 0]?
The callee
refers to the summary entry id of the callee. At most one
of hotness
(which can take the values Unknown
, Cold
, None
,
Hot
, and Critical
), and relbf
(which holds the integer
branch frequency relative to the entry frequency, scaled down by 2^8)
may be specified. The defaults are Unknown
and 0
, respectively.
Params¶
The optional Params
is used by StackSafety
and looks like:
Params: ((Param)[, (Param)]*)
where each Param
describes pointer parameter access inside of the
function and looks like:
param: 4, offset: [0, 5][, calls: ((Callee)[, (Callee)]*)]?
where the first param
is the number of the parameter it describes,
offset
is the inclusive range of offsets from the pointer parameter to bytes
which can be accessed by the function. This range does not include accesses by
function calls from calls
list.
where each Callee
describes how parameter is forwarded into other
functions and looks like:
callee: ^3, param: 5, offset: [-3, 3]
The callee
refers to the summary entry id of the callee, param
is
the number of the callee parameter which points into the callers parameter
with offset known to be inside of the offset
range. calls
will be
consumed and removed by thin link stage to update Param::offset
so it
covers all accesses possible by calls
.
Pointer parameter without corresponding Param
is considered unsafe and we
assume that access with any offset is possible.
Example:
If we have the following function:
define i64 @foo(ptr %0, ptr %1, ptr %2, i8 %3) {
store ptr %1, ptr @x
%5 = getelementptr inbounds i8, ptr %2, i64 5
%6 = load i8, ptr %5
%7 = getelementptr inbounds i8, ptr %2, i8 %3
tail call void @bar(i8 %3, ptr %7)
%8 = load i64, ptr %0
ret i64 %8
}
We can expect the record like this:
params: ((param: 0, offset: [0, 7]),(param: 2, offset: [5, 5], calls: ((callee: ^3, param: 1, offset: [-128, 127]))))
The function may access just 8 bytes of the parameter %0 . calls
is empty,
so the parameter is either not used for function calls or offset
already
covers all accesses from nested function calls.
Parameter %1 escapes, so access is unknown.
The function itself can access just a single byte of the parameter %2. Additional
access is possible inside of the @bar
or ^3
. The function adds signed
offset to the pointer and passes the result as the argument %1 into ^3
.
This record itself does not tell us how ^3
will access the parameter.
Parameter %3 is not a pointer.
Refs¶
The optional Refs
field looks like:
refs: ((Ref)[, (Ref)]*)
where each Ref
contains a reference to the summary id of the referenced
value (e.g. ^1
).
TypeIdInfo¶
The optional TypeIdInfo
field, used for
Control Flow Integrity,
looks like:
typeIdInfo: [(TypeTests)]?[, (TypeTestAssumeVCalls)]?[, (TypeCheckedLoadVCalls)]?[, (TypeTestAssumeConstVCalls)]?[, (TypeCheckedLoadConstVCalls)]?
These optional fields have the following forms:
TypeTests¶
typeTests: (TypeIdRef[, TypeIdRef]*)
Where each TypeIdRef
refers to a type id
by summary id or GUID
.
TypeTestAssumeVCalls¶
typeTestAssumeVCalls: (VFuncId[, VFuncId]*)
Where each VFuncId has the format:
vFuncId: (TypeIdRef, offset: 16)
Where each TypeIdRef
refers to a type id
by summary id or GUID
preceded by a guid:
tag.
TypeCheckedLoadVCalls¶
typeCheckedLoadVCalls: (VFuncId[, VFuncId]*)
Where each VFuncId has the format described for TypeTestAssumeVCalls
.
TypeTestAssumeConstVCalls¶
typeTestAssumeConstVCalls: (ConstVCall[, ConstVCall]*)
Where each ConstVCall has the format:
(VFuncId, args: (Arg[, Arg]*))
and where each VFuncId has the format described for TypeTestAssumeVCalls
,
and each Arg is an integer argument number.
TypeCheckedLoadConstVCalls¶
typeCheckedLoadConstVCalls: (ConstVCall[, ConstVCall]*)
Where each ConstVCall has the format described for
TypeTestAssumeConstVCalls
.
Type ID Summary Entry¶
Each type id summary entry corresponds to a type identifier resolution which is generated during the LTO link portion of the compile when building with Control Flow Integrity, so these are only present in a combined summary index.
Example:
^4 = typeid: (name: "_ZTS1A", summary: (typeTestRes: (kind: allOnes, sizeM1BitWidth: 7[, alignLog2: 0]?[, sizeM1: 0]?[, bitMask: 0]?[, inlineBits: 0]?)[, WpdResolutions]?)) ; guid = 7004155349499253778
The typeTestRes
gives the type test resolution kind
(which may
be unsat
, byteArray
, inline
, single
, or allOnes
), and
the size-1
bit width. It is followed by optional flags, which default to 0,
and an optional WpdResolutions (whole program devirtualization resolution)
field that looks like:
wpdResolutions: ((offset: 0, WpdRes)[, (offset: 1, WpdRes)]*
where each entry is a mapping from the given byte offset to the whole-program devirtualization resolution WpdRes, that has one of the following formats:
wpdRes: (kind: branchFunnel)
wpdRes: (kind: singleImpl, singleImplName: "_ZN1A1nEi")
wpdRes: (kind: indir)
Additionally, each wpdRes has an optional resByArg
field, which
describes the resolutions for calls with all constant integer arguments:
resByArg: (ResByArg[, ResByArg]*)
where ResByArg is:
args: (Arg[, Arg]*), byArg: (kind: UniformRetVal[, info: 0][, byte: 0][, bit: 0])
Where the kind
can be Indir
, UniformRetVal
, UniqueRetVal
or VirtualConstProp
. The info
field is only used if the kind
is UniformRetVal
(indicates the uniform return value), or
UniqueRetVal
(holds the return value associated with the unique vtable
(0 or 1)). The byte
and bit
fields are only used if the target does
not support the use of absolute symbols to store constants.
Intrinsic Global Variables¶
LLVM has a number of “magic” global variables that contain data that
affect code generation or other IR semantics. These are documented here.
All globals of this sort should have a section specified as
“llvm.metadata
”. This section and all globals that start with
“llvm.
” are reserved for use by LLVM.
The ‘llvm.used
’ Global Variable¶
The @llvm.used
global is an array which has
appending linkage. This array contains a list of
pointers to named global variables, functions and aliases which may optionally
have a pointer cast formed of bitcast or getelementptr. For example, a legal
use of it is:
@X = global i8 4
@Y = global i32 123
@llvm.used = appending global [2 x ptr] [
ptr @X,
ptr @Y
], section "llvm.metadata"
If a symbol appears in the @llvm.used
list, then the compiler, assembler,
and linker are required to treat the symbol as if there is a reference to the
symbol that it cannot see (which is why they have to be named). For example, if
a variable has internal linkage and no references other than that from the
@llvm.used
list, it cannot be deleted. This is commonly used to represent
references from inline asms and other things the compiler cannot “see”, and
corresponds to “attribute((used))
” in GNU C.
On some targets, the code generator must emit a directive to the assembler or object file to prevent the assembler and linker from removing the symbol.
The ‘llvm.compiler.used
’ Global Variable¶
The @llvm.compiler.used
directive is the same as the @llvm.used
directive, except that it only prevents the compiler from touching the
symbol. On targets that support it, this allows an intelligent linker to
optimize references to the symbol without being impeded as it would be
by @llvm.used
.
This is a rare construct that should only be used in rare circumstances, and should not be exposed to source languages.
The ‘llvm.global_ctors
’ Global Variable¶
%0 = type { i32, ptr, ptr }
@llvm.global_ctors = appending global [1 x %0] [%0 { i32 65535, ptr @ctor, ptr @data }]
The @llvm.global_ctors
array contains a list of constructor
functions, priorities, and an associated global or function.
The functions referenced by this array will be called in ascending order
of priority (i.e. lowest first) when the module is loaded. The order of
functions with the same priority is not defined.
If the third field is non-null, and points to a global variable or function, the initializer function will only run if the associated data from the current module is not discarded. On ELF the referenced global variable or function must be in a comdat.
The ‘llvm.global_dtors
’ Global Variable¶
%0 = type { i32, ptr, ptr }
@llvm.global_dtors = appending global [1 x %0] [%0 { i32 65535, ptr @dtor, ptr @data }]
The @llvm.global_dtors
array contains a list of destructor
functions, priorities, and an associated global or function.
The functions referenced by this array will be called in descending
order of priority (i.e. highest first) when the module is unloaded. The
order of functions with the same priority is not defined.
If the third field is non-null, and points to a global variable or function, the destructor function will only run if the associated data from the current module is not discarded. On ELF the referenced global variable or function must be in a comdat.
Instruction Reference¶
The LLVM instruction set consists of several different classifications of instructions: terminator instructions, binary instructions, bitwise binary instructions, memory instructions, and other instructions.
Terminator Instructions¶
As mentioned previously, every basic block in a
program ends with a “Terminator” instruction, which indicates which
block should be executed after the current block is finished. These
terminator instructions typically yield a ‘void
’ value: they produce
control flow, not values (the one exception being the
‘invoke’ instruction).
The terminator instructions are: ‘ret’, ‘br’, ‘switch’, ‘indirectbr’, ‘invoke’, ‘callbr’ ‘resume’, ‘catchswitch’, ‘catchret’, ‘cleanupret’, and ‘unreachable’.
‘ret
’ Instruction¶
Syntax:¶
ret <type> <value> ; Return a value from a non-void function
ret void ; Return from void function
Overview:¶
The ‘ret
’ instruction is used to return control flow (and optionally
a value) from a function back to the caller.
There are two forms of the ‘ret
’ instruction: one that returns a
value and then causes control flow, and one that just causes control
flow to occur.
Arguments:¶
The ‘ret
’ instruction optionally accepts a single argument, the
return value. The type of the return value must be a ‘first
class’ type.
A function is not well formed if it has a non-void
return type and contains a ‘ret
’ instruction with no return value or
a return value with a type that does not match its type, or if it has a
void return type and contains a ‘ret
’ instruction with a return
value.
Semantics:¶
When the ‘ret
’ instruction is executed, control flow returns back to
the calling function’s context. If the caller is a
“call” instruction, execution continues at the
instruction after the call. If the caller was an
“invoke” instruction, execution continues at the
beginning of the “normal” destination block. If the instruction returns
a value, that value shall set the call or invoke instruction’s return
value.
Example:¶
ret i32 5 ; Return an integer value of 5
ret void ; Return from a void function
ret { i32, i8 } { i32 4, i8 2 } ; Return a struct of values 4 and 2
‘br
’ Instruction¶
Syntax:¶
br i1 <cond>, label <iftrue>, label <iffalse>
br label <dest> ; Unconditional branch
Overview:¶
The ‘br
’ instruction is used to cause control flow to transfer to a
different basic block in the current function. There are two forms of
this instruction, corresponding to a conditional branch and an
unconditional branch.
Arguments:¶
The conditional branch form of the ‘br
’ instruction takes a single
‘i1
’ value and two ‘label
’ values. The unconditional form of the
‘br
’ instruction takes a single ‘label
’ value as a target.
Semantics:¶
Upon execution of a conditional ‘br
’ instruction, the ‘i1
’
argument is evaluated. If the value is true
, control flows to the
‘iftrue
’ label
argument. If “cond” is false
, control flows
to the ‘iffalse
’ label
argument.
If ‘cond
’ is poison
or undef
, this instruction has undefined
behavior.
Example:¶
Test:
%cond = icmp eq i32 %a, %b
br i1 %cond, label %IfEqual, label %IfUnequal
IfEqual:
ret i32 1
IfUnequal:
ret i32 0
‘switch
’ Instruction¶
Syntax:¶
switch <intty> <value>, label <defaultdest> [ <intty> <val>, label <dest> ... ]
Overview:¶
The ‘switch
’ instruction is used to transfer control flow to one of
several different places. It is a generalization of the ‘br
’
instruction, allowing a branch to occur to one of many possible
destinations.
Arguments:¶
The ‘switch
’ instruction uses three parameters: an integer
comparison value ‘value
’, a default ‘label
’ destination, and an
array of pairs of comparison value constants and ‘label
’s. The table
is not allowed to contain duplicate constant entries.
Semantics:¶
The switch
instruction specifies a table of values and destinations.
When the ‘switch
’ instruction is executed, this table is searched
for the given value. If the value is found, control flow is transferred
to the corresponding destination; otherwise, control flow is transferred
to the default destination.
If ‘value
’ is poison
or undef
, this instruction has undefined
behavior.
Implementation:¶
Depending on properties of the target machine and the particular
switch
instruction, this instruction may be code generated in
different ways. For example, it could be generated as a series of
chained conditional branches or with a lookup table.
Example:¶
; Emulate a conditional br instruction
%Val = zext i1 %value to i32
switch i32 %Val, label %truedest [ i32 0, label %falsedest ]
; Emulate an unconditional br instruction
switch i32 0, label %dest [ ]
; Implement a jump table:
switch i32 %val, label %otherwise [ i32 0, label %onzero
i32 1, label %onone
i32 2, label %ontwo ]
‘indirectbr
’ Instruction¶
Syntax:¶
indirectbr ptr <address>, [ label <dest1>, label <dest2>, ... ]
Overview:¶
The ‘indirectbr
’ instruction implements an indirect branch to a
label within the current function, whose address is specified by
“address
”. Address must be derived from a
blockaddress constant.
Arguments:¶
The ‘address
’ argument is the address of the label to jump to. The
rest of the arguments indicate the full set of possible destinations
that the address may point to. Blocks are allowed to occur multiple
times in the destination list, though this isn’t particularly useful.
This destination list is required so that dataflow analysis has an accurate understanding of the CFG.
Semantics:¶
Control transfers to the block specified in the address argument. All
possible destination blocks must be listed in the label list, otherwise
this instruction has undefined behavior. This implies that jumps to
labels defined in other functions have undefined behavior as well.
If ‘address
’ is poison
or undef
, this instruction has undefined
behavior.
Implementation:¶
This is typically implemented with a jump through a register.
Example:¶
indirectbr ptr %Addr, [ label %bb1, label %bb2, label %bb3 ]
‘invoke
’ Instruction¶
Syntax:¶
<result> = invoke [cconv] [ret attrs] [addrspace(<num>)] <ty>|<fnty> <fnptrval>(<function args>) [fn attrs]
[operand bundles] to label <normal label> unwind label <exception label>
Overview:¶
The ‘invoke
’ instruction causes control to transfer to a specified
function, with the possibility of control flow transfer to either the
‘normal
’ label or the ‘exception
’ label. If the callee function
returns with the “ret
” instruction, control flow will return to the
“normal” label. If the callee (or any indirect callees) returns via the
“resume” instruction or other exception handling
mechanism, control is interrupted and continued at the dynamically
nearest “exception” label.
The ‘exception
’ label is a landing
pad for the exception. As such,
‘exception
’ label is required to have the
“landingpad” instruction, which contains the
information about the behavior of the program after unwinding happens,
as its first non-PHI instruction. The restrictions on the
“landingpad
” instruction’s tightly couples it to the “invoke
”
instruction, so that the important information contained within the
“landingpad
” instruction can’t be lost through normal code motion.
Arguments:¶
This instruction requires several arguments:
The optional “cconv” marker indicates which calling convention the call should use. If none is specified, the call defaults to using C calling conventions.
The optional Parameter Attributes list for return values. Only ‘
zeroext
’, ‘signext
’, and ‘inreg
’ attributes are valid here.The optional addrspace attribute can be used to indicate the address space of the called function. If it is not specified, the program address space from the datalayout string will be used.
‘
ty
’: the type of the call instruction itself which is also the type of the return value. Functions that return no value are markedvoid
.‘
fnty
’: shall be the signature of the function being invoked. The argument types must match the types implied by this signature. This type can be omitted if the function is not varargs.‘
fnptrval
’: An LLVM value containing a pointer to a function to be invoked. In most cases, this is a direct function invocation, but indirectinvoke
’s are just as possible, calling an arbitrary pointer to function value.‘
function args
’: argument list whose types match the function signature argument types and parameter attributes. All arguments must be of first class type. If the function signature indicates the function accepts a variable number of arguments, the extra arguments can be specified.‘
normal label
’: the label reached when the called function executes a ‘ret
’ instruction.‘
exception label
’: the label reached when a callee returns via the resume instruction or other exception handling mechanism.The optional function attributes list.
The optional operand bundles list.
Semantics:¶
This instruction is designed to operate as a standard ‘call
’
instruction in most regards. The primary difference is that it
establishes an association with a label, which is used by the runtime
library to unwind the stack.
This instruction is used in languages with destructors to ensure that
proper cleanup is performed in the case of either a longjmp
or a
thrown exception. Additionally, this is important for implementation of
‘catch
’ clauses in high-level languages that support them.
For the purposes of the SSA form, the definition of the value returned
by the ‘invoke
’ instruction is deemed to occur on the edge from the
current block to the “normal” label. If the callee unwinds then no
return value is available.
Example:¶
%retval = invoke i32 @Test(i32 15) to label %Continue
unwind label %TestCleanup ; i32:retval set
%retval = invoke coldcc i32 %Testfnptr(i32 15) to label %Continue
unwind label %TestCleanup ; i32:retval set
‘callbr
’ Instruction¶
Syntax:¶
<result> = callbr [cconv] [ret attrs] [addrspace(<num>)] <ty>|<fnty> <fnptrval>(<function args>) [fn attrs]
[operand bundles] to label <fallthrough label> [indirect labels]
Overview:¶
The ‘callbr
’ instruction causes control to transfer to a specified
function, with the possibility of control flow transfer to either the
‘fallthrough
’ label or one of the ‘indirect
’ labels.
This instruction should only be used to implement the “goto” feature of gcc style inline assembly. Any other usage is an error in the IR verifier.
Note that in order to support outputs along indirect edges, LLVM may need to
split critical edges, which may require synthesizing a replacement block for
the indirect labels
. Therefore, the address of a label as seen by another
callbr
instruction, or for a blockaddress constant,
may not be equal to the address provided for the same block to this
instruction’s indirect labels
operand. The assembly code may only transfer
control to addresses provided via this instruction’s indirect labels
.
Arguments:¶
This instruction requires several arguments:
The optional “cconv” marker indicates which calling convention the call should use. If none is specified, the call defaults to using C calling conventions.
The optional Parameter Attributes list for return values. Only ‘
zeroext
’, ‘signext
’, and ‘inreg
’ attributes are valid here.The optional addrspace attribute can be used to indicate the address space of the called function. If it is not specified, the program address space from the datalayout string will be used.
‘
ty
’: the type of the call instruction itself which is also the type of the return value. Functions that return no value are markedvoid
.‘
fnty
’: shall be the signature of the function being called. The argument types must match the types implied by this signature. This type can be omitted if the function is not varargs.‘
fnptrval
’: An LLVM value containing a pointer to a function to be called. In most cases, this is a direct function call, but othercallbr
’s are just as possible, calling an arbitrary pointer to function value.‘
function args
’: argument list whose types match the function signature argument types and parameter attributes. All arguments must be of first class type. If the function signature indicates the function accepts a variable number of arguments, the extra arguments can be specified.‘
fallthrough label
’: the label reached when the inline assembly’s execution exits the bottom.‘
indirect labels
’: the labels reached when a callee transfers control to a location other than the ‘fallthrough label
’. Label constraints refer to these destinations.The optional function attributes list.
The optional operand bundles list.
Semantics:¶
This instruction is designed to operate as a standard ‘call
’
instruction in most regards. The primary difference is that it
establishes an association with additional labels to define where control
flow goes after the call.
The output values of a ‘callbr
’ instruction are available only to
the ‘fallthrough
’ block, not to any ‘indirect
’ blocks(s).
The only use of this today is to implement the “goto” feature of gcc inline assembly where additional labels can be provided as locations for the inline assembly to jump to.
Example:¶
; "asm goto" without output constraints.
callbr void asm "", "r,!i"(i32 %x)
to label %fallthrough [label %indirect]
; "asm goto" with output constraints.
<result> = callbr i32 asm "", "=r,r,!i"(i32 %x)
to label %fallthrough [label %indirect]
‘resume
’ Instruction¶
Syntax:¶
resume <type> <value>
Overview:¶
The ‘resume
’ instruction is a terminator instruction that has no
successors.
Arguments:¶
The ‘resume
’ instruction requires one argument, which must have the
same type as the result of any ‘landingpad
’ instruction in the same
function.
Semantics:¶
The ‘resume
’ instruction resumes propagation of an existing
(in-flight) exception whose unwinding was interrupted with a
landingpad instruction.
Example:¶
resume { ptr, i32 } %exn
‘catchswitch
’ Instruction¶
Syntax:¶
<resultval> = catchswitch within <parent> [ label <handler1>, label <handler2>, ... ] unwind to caller
<resultval> = catchswitch within <parent> [ label <handler1>, label <handler2>, ... ] unwind label <default>
Overview:¶
The ‘catchswitch
’ instruction is used by LLVM’s exception handling system to describe the set of possible catch handlers
that may be executed by the EH personality routine.
Arguments:¶
The parent
argument is the token of the funclet that contains the
catchswitch
instruction. If the catchswitch
is not inside a funclet,
this operand may be the token none
.
The default
argument is the label of another basic block beginning with
either a cleanuppad
or catchswitch
instruction. This unwind destination
must be a legal target with respect to the parent
links, as described in
the exception handling documentation.
The handlers
are a nonempty list of successor blocks that each begin with a
catchpad instruction.
Semantics:¶
Executing this instruction transfers control to one of the successors in
handlers
, if appropriate, or continues to unwind via the unwind label if
present.
The catchswitch
is both a terminator and a “pad” instruction, meaning that
it must be both the first non-phi instruction and last instruction in the basic
block. Therefore, it must be the only non-phi instruction in the block.
Example:¶
dispatch1:
%cs1 = catchswitch within none [label %handler0, label %handler1] unwind to caller
dispatch2:
%cs2 = catchswitch within %parenthandler [label %handler0] unwind label %cleanup
‘catchret
’ Instruction¶
Syntax:¶
catchret from <token> to label <normal>
Overview:¶
The ‘catchret
’ instruction is a terminator instruction that has a
single successor.
Arguments:¶
The first argument to a ‘catchret
’ indicates which catchpad
it
exits. It must be a catchpad.
The second argument to a ‘catchret
’ specifies where control will
transfer to next.
Semantics:¶
The ‘catchret
’ instruction ends an existing (in-flight) exception whose
unwinding was interrupted with a catchpad instruction. The
personality function gets a chance to execute arbitrary
code to, for example, destroy the active exception. Control then transfers to
normal
.
The token
argument must be a token produced by a catchpad
instruction.
If the specified catchpad
is not the most-recently-entered not-yet-exited
funclet pad (as described in the EH documentation),
the catchret
’s behavior is undefined.
Example:¶
catchret from %catch to label %continue
‘cleanupret
’ Instruction¶
Syntax:¶
cleanupret from <value> unwind label <continue>
cleanupret from <value> unwind to caller
Overview:¶
The ‘cleanupret
’ instruction is a terminator instruction that has
an optional successor.
Arguments:¶
The ‘cleanupret
’ instruction requires one argument, which indicates
which cleanuppad
it exits, and must be a cleanuppad.
If the specified cleanuppad
is not the most-recently-entered not-yet-exited
funclet pad (as described in the EH documentation),
the cleanupret
’s behavior is undefined.
The ‘cleanupret
’ instruction also has an optional successor, continue
,
which must be the label of another basic block beginning with either a
cleanuppad
or catchswitch
instruction. This unwind destination must
be a legal target with respect to the parent
links, as described in the
exception handling documentation.
Semantics:¶
The ‘cleanupret
’ instruction indicates to the
personality function that one
cleanuppad it transferred control to has ended.
It transfers control to continue
or unwinds out of the function.
Example:¶
cleanupret from %cleanup unwind to caller
cleanupret from %cleanup unwind label %continue
‘unreachable
’ Instruction¶
Syntax:¶
unreachable
Overview:¶
The ‘unreachable
’ instruction has no defined semantics. This
instruction is used to inform the optimizer that a particular portion of
the code is not reachable. This can be used to indicate that the code
after a no-return function cannot be reached, and other facts.
Semantics:¶
The ‘unreachable
’ instruction has no defined semantics.
Unary Operations¶
Unary operators require a single operand, execute an operation on it, and produce a single value. The operand might represent multiple data, as is the case with the vector data type. The result value has the same type as its operand.
‘fneg
’ Instruction¶
Syntax:¶
<result> = fneg [fast-math flags]* <ty> <op1> ; yields ty:result
Overview:¶
The ‘fneg
’ instruction returns the negation of its operand.
Arguments:¶
The argument to the ‘fneg
’ instruction must be a
floating-point or vector of
floating-point values.
Semantics:¶
The value produced is a copy of the operand with its sign bit flipped. The value is otherwise completely identical; in particular, if the input is a NaN, then the quiet/signaling bit and payload are perfectly preserved.
This instruction can also take any number of fast-math flags, which are optimization hints to enable otherwise unsafe floating-point optimizations:
Example:¶
<result> = fneg float %val ; yields float:result = -%var
Binary Operations¶
Binary operators are used to do most of the computation in a program. They require two operands of the same type, execute an operation on them, and produce a single value. The operands might represent multiple data, as is the case with the vector data type. The result value has the same type as its operands.
There are several different binary operators:
‘add
’ Instruction¶
Syntax:¶
<result> = add <ty> <op1>, <op2> ; yields ty:result
<result> = add nuw <ty> <op1>, <op2> ; yields ty:result
<result> = add nsw <ty> <op1>, <op2> ; yields ty:result
<result> = add nuw nsw <ty> <op1>, <op2> ; yields ty:result
Overview:¶
The ‘add
’ instruction returns the sum of its two operands.
Arguments:¶
The two arguments to the ‘add
’ instruction must be
integer or vector of integer values. Both
arguments must have identical types.
Semantics:¶
The value produced is the integer sum of the two operands.
If the sum has unsigned overflow, the result returned is the mathematical result modulo 2n, where n is the bit width of the result.
Because LLVM integers use a two’s complement representation, this instruction is appropriate for both signed and unsigned integers.
nuw
and nsw
stand for “No Unsigned Wrap” and “No Signed Wrap”,
respectively. If the nuw
and/or nsw
keywords are present, the
result value of the add
is a poison value if
unsigned and/or signed overflow, respectively, occurs.
Example:¶
<result> = add i32 4, %var ; yields i32:result = 4 + %var
‘fadd
’ Instruction¶
Syntax:¶
<result> = fadd [fast-math flags]* <ty> <op1>, <op2> ; yields ty:result
Overview:¶
The ‘fadd
’ instruction returns the sum of its two operands.
Arguments:¶
The two arguments to the ‘fadd
’ instruction must be
floating-point or vector of
floating-point values. Both arguments must have identical types.
Semantics:¶
The value produced is the floating-point sum of the two operands. This instruction is assumed to execute in the default floating-point environment. This instruction can also take any number of fast-math flags, which are optimization hints to enable otherwise unsafe floating-point optimizations:
Example:¶
<result> = fadd float 4.0, %var ; yields float:result = 4.0 + %var
‘sub
’ Instruction¶
Syntax:¶
<result> = sub <ty> <op1>, <op2> ; yields ty:result
<result> = sub nuw <ty> <op1>, <op2> ; yields ty:result
<result> = sub nsw <ty> <op1>, <op2> ; yields ty:result
<result> = sub nuw nsw <ty> <op1>, <op2> ; yields ty:result
Overview:¶
The ‘sub
’ instruction returns the difference of its two operands.
Note that the ‘sub
’ instruction is used to represent the ‘neg
’
instruction present in most other intermediate representations.
Arguments:¶
The two arguments to the ‘sub
’ instruction must be
integer or vector of integer values. Both
arguments must have identical types.
Semantics:¶
The value produced is the integer difference of the two operands.
If the difference has unsigned overflow, the result returned is the mathematical result modulo 2n, where n is the bit width of the result.
Because LLVM integers use a two’s complement representation, this instruction is appropriate for both signed and unsigned integers.
nuw
and nsw
stand for “No Unsigned Wrap” and “No Signed Wrap”,
respectively. If the nuw
and/or nsw
keywords are present, the
result value of the sub
is a poison value if
unsigned and/or signed overflow, respectively, occurs.
Example:¶
<result> = sub i32 4, %var ; yields i32:result = 4 - %var
<result> = sub i32 0, %val ; yields i32:result = -%var
‘fsub
’ Instruction¶
Syntax:¶
<result> = fsub [fast-math flags]* <ty> <op1>, <op2> ; yields ty:result
Overview:¶
The ‘fsub
’ instruction returns the difference of its two operands.
Arguments:¶
The two arguments to the ‘fsub
’ instruction must be
floating-point or vector of
floating-point values. Both arguments must have identical types.
Semantics:¶
The value produced is the floating-point difference of the two operands. This instruction is assumed to execute in the default floating-point environment. This instruction can also take any number of fast-math flags, which are optimization hints to enable otherwise unsafe floating-point optimizations:
Example:¶
<result> = fsub float 4.0, %var ; yields float:result = 4.0 - %var
<result> = fsub float -0.0, %val ; yields float:result = -%var
‘mul
’ Instruction¶
Syntax:¶
<result> = mul <ty> <op1>, <op2> ; yields ty:result
<result> = mul nuw <ty> <op1>, <op2> ; yields ty:result
<result> = mul nsw <ty> <op1>, <op2> ; yields ty:result
<result> = mul nuw nsw <ty> <op1>, <op2> ; yields ty:result
Overview:¶
The ‘mul
’ instruction returns the product of its two operands.
Arguments:¶
The two arguments to the ‘mul
’ instruction must be
integer or vector of integer values. Both
arguments must have identical types.
Semantics:¶
The value produced is the integer product of the two operands.
If the result of the multiplication has unsigned overflow, the result returned is the mathematical result modulo 2n, where n is the bit width of the result.
Because LLVM integers use a two’s complement representation, and the
result is the same width as the operands, this instruction returns the
correct result for both signed and unsigned integers. If a full product
(e.g. i32
* i32
-> i64
) is needed, the operands should be
sign-extended or zero-extended as appropriate to the width of the full
product.
nuw
and nsw
stand for “No Unsigned Wrap” and “No Signed Wrap”,
respectively. If the nuw
and/or nsw
keywords are present, the
result value of the mul
is a poison value if
unsigned and/or signed overflow, respectively, occurs.
Example:¶
<result> = mul i32 4, %var ; yields i32:result = 4 * %var
‘fmul
’ Instruction¶
Syntax:¶
<result> = fmul [fast-math flags]* <ty> <op1>, <op2> ; yields ty:result
Overview:¶
The ‘fmul
’ instruction returns the product of its two operands.
Arguments:¶
The two arguments to the ‘fmul
’ instruction must be
floating-point or vector of
floating-point values. Both arguments must have identical types.
Semantics:¶
The value produced is the floating-point product of the two operands. This instruction is assumed to execute in the default floating-point environment. This instruction can also take any number of fast-math flags, which are optimization hints to enable otherwise unsafe floating-point optimizations:
Example:¶
<result> = fmul float 4.0, %var ; yields float:result = 4.0 * %var
‘udiv
’ Instruction¶
Syntax:¶
<result> = udiv <ty> <op1>, <op2> ; yields ty:result
<result> = udiv exact <ty> <op1>, <op2> ; yields ty:result
Overview:¶
The ‘udiv
’ instruction returns the quotient of its two operands.
Arguments:¶
The two arguments to the ‘udiv
’ instruction must be
integer or vector of integer values. Both
arguments must have identical types.
Semantics:¶
The value produced is the unsigned integer quotient of the two operands.
Note that unsigned integer division and signed integer division are
distinct operations; for signed integer division, use ‘sdiv
’.
Division by zero is undefined behavior. For vectors, if any element of the divisor is zero, the operation has undefined behavior.
If the exact
keyword is present, the result value of the udiv
is
a poison value if %op1 is not a multiple of %op2 (as
such, “((a udiv exact b) mul b) == a”).
Example:¶
<result> = udiv i32 4, %var ; yields i32:result = 4 / %var
‘sdiv
’ Instruction¶
Syntax:¶
<result> = sdiv <ty> <op1>, <op2> ; yields ty:result
<result> = sdiv exact <ty> <op1>, <op2> ; yields ty:result
Overview:¶
The ‘sdiv
’ instruction returns the quotient of its two operands.
Arguments:¶
The two arguments to the ‘sdiv
’ instruction must be
integer or vector of integer values. Both
arguments must have identical types.
Semantics:¶
The value produced is the signed integer quotient of the two operands rounded towards zero.
Note that signed integer division and unsigned integer division are
distinct operations; for unsigned integer division, use ‘udiv
’.
Division by zero is undefined behavior. For vectors, if any element of the divisor is zero, the operation has undefined behavior. Overflow also leads to undefined behavior; this is a rare case, but can occur, for example, by doing a 32-bit division of -2147483648 by -1.
If the exact
keyword is present, the result value of the sdiv
is
a poison value if the result would be rounded.
Example:¶
<result> = sdiv i32 4, %var ; yields i32:result = 4 / %var
‘fdiv
’ Instruction¶
Syntax:¶
<result> = fdiv [fast-math flags]* <ty> <op1>, <op2> ; yields ty:result
Overview:¶
The ‘fdiv
’ instruction returns the quotient of its two operands.
Arguments:¶
The two arguments to the ‘fdiv
’ instruction must be
floating-point or vector of
floating-point values. Both arguments must have identical types.
Semantics:¶
The value produced is the floating-point quotient of the two operands. This instruction is assumed to execute in the default floating-point environment. This instruction can also take any number of fast-math flags, which are optimization hints to enable otherwise unsafe floating-point optimizations:
Example:¶
<result> = fdiv float 4.0, %var ; yields float:result = 4.0 / %var
‘urem
’ Instruction¶
Syntax:¶
<result> = urem <ty> <op1>, <op2> ; yields ty:result
Overview:¶
The ‘urem
’ instruction returns the remainder from the unsigned
division of its two arguments.
Arguments:¶
The two arguments to the ‘urem
’ instruction must be
integer or vector of integer values. Both
arguments must have identical types.
Semantics:¶
This instruction returns the unsigned integer remainder of a division. This instruction always performs an unsigned division to get the remainder.
Note that unsigned integer remainder and signed integer remainder are
distinct operations; for signed integer remainder, use ‘srem
’.
Taking the remainder of a division by zero is undefined behavior. For vectors, if any element of the divisor is zero, the operation has undefined behavior.
Example:¶
<result> = urem i32 4, %var ; yields i32:result = 4 % %var
‘srem
’ Instruction¶
Syntax:¶
<result> = srem <ty> <op1>, <op2> ; yields ty:result
Overview:¶
The ‘srem
’ instruction returns the remainder from the signed
division of its two operands. This instruction can also take
vector versions of the values in which case the elements
must be integers.
Arguments:¶
The two arguments to the ‘srem
’ instruction must be
integer or vector of integer values. Both
arguments must have identical types.
Semantics:¶
This instruction returns the remainder of a division (where the result
is either zero or has the same sign as the dividend, op1
), not the
modulo operator (where the result is either zero or has the same sign
as the divisor, op2
) of a value. For more information about the
difference, see The Math
Forum. For a
table of how this is implemented in various languages, please see
Wikipedia: modulo
operation.
Note that signed integer remainder and unsigned integer remainder are
distinct operations; for unsigned integer remainder, use ‘urem
’.
Taking the remainder of a division by zero is undefined behavior. For vectors, if any element of the divisor is zero, the operation has undefined behavior. Overflow also leads to undefined behavior; this is a rare case, but can occur, for example, by taking the remainder of a 32-bit division of -2147483648 by -1. (The remainder doesn’t actually overflow, but this rule lets srem be implemented using instructions that return both the result of the division and the remainder.)
Example:¶
<result> = srem i32 4, %var ; yields i32:result = 4 % %var
‘frem
’ Instruction¶
Syntax:¶
<result> = frem [fast-math flags]* <ty> <op1>, <op2> ; yields ty:result
Overview:¶
The ‘frem
’ instruction returns the remainder from the division of
its two operands.
Note
The instruction is implemented as a call to libm’s ‘fmod
’
for some targets, and using the instruction may thus require linking libm.
Arguments:¶
The two arguments to the ‘frem
’ instruction must be
floating-point or vector of
floating-point values. Both arguments must have identical types.
Semantics:¶
The value produced is the floating-point remainder of the two operands.
This is the same output as a libm ‘fmod
’ function, but without any
possibility of setting errno
. The remainder has the same sign as the
dividend.
This instruction is assumed to execute in the default floating-point
environment.
This instruction can also take any number of fast-math
flags, which are optimization hints to enable otherwise
unsafe floating-point optimizations:
Example:¶
<result> = frem float 4.0, %var ; yields float:result = 4.0 % %var
Bitwise Binary Operations¶
Bitwise binary operators are used to do various forms of bit-twiddling in a program. They are generally very efficient instructions and can commonly be strength reduced from other instructions. They require two operands of the same type, execute an operation on them, and produce a single value. The resulting value is the same type as its operands.
‘shl
’ Instruction¶
Syntax:¶
<result> = shl <ty> <op1>, <op2> ; yields ty:result
<result> = shl nuw <ty> <op1>, <op2> ; yields ty:result
<result> = shl nsw <ty> <op1>, <op2> ; yields ty:result
<result> = shl nuw nsw <ty> <op1>, <op2> ; yields ty:result
Overview:¶
The ‘shl
’ instruction returns the first operand shifted to the left
a specified number of bits.
Arguments:¶
Both arguments to the ‘shl
’ instruction must be the same
integer or vector of integer type.
‘op2
’ is treated as an unsigned value.
Semantics:¶
The value produced is op1
* 2op2 mod 2n,
where n
is the width of the result. If op2
is (statically or
dynamically) equal to or larger than the number of bits in
op1
, this instruction returns a poison value.
If the arguments are vectors, each vector element of op1
is shifted
by the corresponding shift amount in op2
.
If the nuw
keyword is present, then the shift produces a poison
value if it shifts out any non-zero bits.
If the nsw
keyword is present, then the shift produces a poison
value if it shifts out any bits that disagree with the resultant sign bit.
Example:¶
<result> = shl i32 4, %var ; yields i32: 4 << %var
<result> = shl i32 4, 2 ; yields i32: 16
<result> = shl i32 1, 10 ; yields i32: 1024
<result> = shl i32 1, 32 ; undefined
<result> = shl <2 x i32> < i32 1, i32 1>, < i32 1, i32 2> ; yields: result=<2 x i32> < i32 2, i32 4>
‘lshr
’ Instruction¶
Syntax:¶
<result> = lshr <ty> <op1>, <op2> ; yields ty:result
<result> = lshr exact <ty> <op1>, <op2> ; yields ty:result
Overview:¶
The ‘lshr
’ instruction (logical shift right) returns the first
operand shifted to the right a specified number of bits with zero fill.
Arguments:¶
Both arguments to the ‘lshr
’ instruction must be the same
integer or vector of integer type.
‘op2
’ is treated as an unsigned value.
Semantics:¶
This instruction always performs a logical shift right operation. The
most significant bits of the result will be filled with zero bits after
the shift. If op2
is (statically or dynamically) equal to or larger
than the number of bits in op1
, this instruction returns a poison
value. If the arguments are vectors, each vector element
of op1
is shifted by the corresponding shift amount in op2
.
If the exact
keyword is present, the result value of the lshr
is
a poison value if any of the bits shifted out are non-zero.
Example:¶
<result> = lshr i32 4, 1 ; yields i32:result = 2
<result> = lshr i32 4, 2 ; yields i32:result = 1
<result> = lshr i8 4, 3 ; yields i8:result = 0
<result> = lshr i8 -2, 1 ; yields i8:result = 0x7F
<result> = lshr i32 1, 32 ; undefined
<result> = lshr <2 x i32> < i32 -2, i32 4>, < i32 1, i32 2> ; yields: result=<2 x i32> < i32 0x7FFFFFFF, i32 1>
‘ashr
’ Instruction¶
Syntax:¶
<result> = ashr <ty> <op1>, <op2> ; yields ty:result
<result> = ashr exact <ty> <op1>, <op2> ; yields ty:result
Overview:¶
The ‘ashr
’ instruction (arithmetic shift right) returns the first
operand shifted to the right a specified number of bits with sign
extension.
Arguments:¶
Both arguments to the ‘ashr
’ instruction must be the same
integer or vector of integer type.
‘op2
’ is treated as an unsigned value.
Semantics:¶
This instruction always performs an arithmetic shift right operation,
The most significant bits of the result will be filled with the sign bit
of op1
. If op2
is (statically or dynamically) equal to or larger
than the number of bits in op1
, this instruction returns a poison
value. If the arguments are vectors, each vector element
of op1
is shifted by the corresponding shift amount in op2
.
If the exact
keyword is present, the result value of the ashr
is
a poison value if any of the bits shifted out are non-zero.
Example:¶
<result> = ashr i32 4, 1 ; yields i32:result = 2
<result> = ashr i32 4, 2 ; yields i32:result = 1
<result> = ashr i8 4, 3 ; yields i8:result = 0
<result> = ashr i8 -2, 1 ; yields i8:result = -1
<result> = ashr i32 1, 32 ; undefined
<result> = ashr <2 x i32> < i32 -2, i32 4>, < i32 1, i32 3> ; yields: result=<2 x i32> < i32 -1, i32 0>
‘and
’ Instruction¶
Syntax:¶
<result> = and <ty> <op1>, <op2> ; yields ty:result
Overview:¶
The ‘and
’ instruction returns the bitwise logical and of its two
operands.
Arguments:¶
The two arguments to the ‘and
’ instruction must be
integer or vector of integer values. Both
arguments must have identical types.
Semantics:¶
The truth table used for the ‘and
’ instruction is:
In0 |
In1 |
Out |
0 |
0 |
0 |
0 |
1 |
0 |
1 |
0 |
0 |
1 |
1 |
1 |
Example:¶
<result> = and i32 4, %var ; yields i32:result = 4 & %var
<result> = and i32 15, 40 ; yields i32:result = 8
<result> = and i32 4, 8 ; yields i32:result = 0
‘or
’ Instruction¶
Syntax:¶
<result> = or <ty> <op1>, <op2> ; yields ty:result
<result> = or disjoint <ty> <op1>, <op2> ; yields ty:result
Overview:¶
The ‘or
’ instruction returns the bitwise logical inclusive or of its
two operands.
Arguments:¶
The two arguments to the ‘or
’ instruction must be
integer or vector of integer values. Both
arguments must have identical types.
Semantics:¶
The truth table used for the ‘or
’ instruction is:
In0 |
In1 |
Out |
0 |
0 |
0 |
0 |
1 |
1 |
1 |
0 |
1 |
1 |
1 |
1 |
disjoint
means that for each bit, that bit is zero in at least one of the
inputs. This allows the Or to be treated as an Add since no carry can occur from
any bit. If the disjoint keyword is present, the result value of the or
is a
poison value if both inputs have a one in the same bit
position. For vectors, only the element containing the bit is poison.
Example:¶
<result> = or i32 4, %var ; yields i32:result = 4 | %var
<result> = or i32 15, 40 ; yields i32:result = 47
<result> = or i32 4, 8 ; yields i32:result = 12
‘xor
’ Instruction¶
Syntax:¶
<result> = xor <ty> <op1>, <op2> ; yields ty:result
Overview:¶
The ‘xor
’ instruction returns the bitwise logical exclusive or of
its two operands. The xor
is used to implement the “one’s
complement” operation, which is the “~” operator in C.
Arguments:¶
The two arguments to the ‘xor
’ instruction must be
integer or vector of integer values. Both
arguments must have identical types.
Semantics:¶
The truth table used for the ‘xor
’ instruction is:
In0 |
In1 |
Out |
0 |
0 |
0 |
0 |
1 |
1 |
1 |
0 |
1 |
1 |
1 |
0 |
Example:¶
<result> = xor i32 4, %var ; yields i32:result = 4 ^ %var
<result> = xor i32 15, 40 ; yields i32:result = 39
<result> = xor i32 4, 8 ; yields i32:result = 12
<result> = xor i32 %V, -1 ; yields i32:result = ~%V
Vector Operations¶
LLVM supports several instructions to represent vector operations in a target-independent manner. These instructions cover the element-access and vector-specific operations needed to process vectors effectively. While LLVM does directly support these vector operations, many sophisticated algorithms will want to use target-specific intrinsics to take full advantage of a specific target.
‘extractelement
’ Instruction¶
Syntax:¶
<result> = extractelement <n x <ty>> <val>, <ty2> <idx> ; yields <ty>
<result> = extractelement <vscale x n x <ty>> <val>, <ty2> <idx> ; yields <ty>
Overview:¶
The ‘extractelement
’ instruction extracts a single scalar element
from a vector at a specified index.
Arguments:¶
The first operand of an ‘extractelement
’ instruction is a value of
vector type. The second operand is an index indicating
the position from which to extract the element. The index may be a
variable of any integer type, and will be treated as an unsigned integer.
Semantics:¶
The result is a scalar of the same type as the element type of val
.
Its value is the value at position idx
of val
. If idx
exceeds the length of val
for a fixed-length vector, the result is a
poison value. For a scalable vector, if the value
of idx
exceeds the runtime length of the vector, the result is a
poison value.
Example:¶
<result> = extractelement <4 x i32> %vec, i32 0 ; yields i32
‘insertelement
’ Instruction¶
Syntax:¶
<result> = insertelement <n x <ty>> <val>, <ty> <elt>, <ty2> <idx> ; yields <n x <ty>>
<result> = insertelement <vscale x n x <ty>> <val>, <ty> <elt>, <ty2> <idx> ; yields <vscale x n x <ty>>
Overview:¶
The ‘insertelement
’ instruction inserts a scalar element into a
vector at a specified index.
Arguments:¶
The first operand of an ‘insertelement
’ instruction is a value of
vector type. The second operand is a scalar value whose
type must equal the element type of the first operand. The third operand
is an index indicating the position at which to insert the value. The
index may be a variable of any integer type, and will be treated as an
unsigned integer.
Semantics:¶
The result is a vector of the same type as val
. Its element values
are those of val
except at position idx
, where it gets the value
elt
. If idx
exceeds the length of val
for a fixed-length vector,
the result is a poison value. For a scalable vector,
if the value of idx
exceeds the runtime length of the vector, the result
is a poison value.
Example:¶
<result> = insertelement <4 x i32> %vec, i32 1, i32 0 ; yields <4 x i32>
‘shufflevector
’ Instruction¶
Syntax:¶
<result> = shufflevector <n x <ty>> <v1>, <n x <ty>> <v2>, <m x i32> <mask> ; yields <m x <ty>>
<result> = shufflevector <vscale x n x <ty>> <v1>, <vscale x n x <ty>> v2, <vscale x m x i32> <mask> ; yields <vscale x m x <ty>>
Overview:¶
The ‘shufflevector
’ instruction constructs a permutation of elements
from two input vectors, returning a vector with the same element type as
the input and length that is the same as the shuffle mask.
Arguments:¶
The first two operands of a ‘shufflevector
’ instruction are vectors
with the same type. The third argument is a shuffle mask vector constant
whose element type is i32
. The mask vector elements must be constant
integers or poison
values. The result of the instruction is a vector
whose length is the same as the shuffle mask and whose element type is the
same as the element type of the first two operands.
Semantics:¶
The elements of the two input vectors are numbered from left to right across both of the vectors. For each element of the result vector, the shuffle mask selects an element from one of the input vectors to copy to the result. Non-negative elements in the mask represent an index into the concatenated pair of input vectors.
A poison
element in the mask vector specifies that the resulting element
is poison
.
For backwards-compatibility reasons, LLVM temporarily also accepts undef
mask elements, which will be interpreted the same way as poison
elements.
If the shuffle mask selects an undef
element from one of the input
vectors, the resulting element is undef
.
For scalable vectors, the only valid mask values at present are
zeroinitializer
, undef
and poison
, since we cannot write all indices as
literals for a vector with a length unknown at compile time.
Example:¶
<result> = shufflevector <4 x i32> %v1, <4 x i32> %v2,
<4 x i32> <i32 0, i32 4, i32 1, i32 5> ; yields <4 x i32>
<result> = shufflevector <4 x i32> %v1, <4 x i32> poison,
<4 x i32> <i32 0, i32 1, i32 2, i32 3> ; yields <4 x i32> - Identity shuffle.
<result> = shufflevector <8 x i32> %v1, <8 x i32> poison,
<4 x i32> <i32 0, i32 1, i32 2, i32 3> ; yields <4 x i32>
<result> = shufflevector <4 x i32> %v1, <4 x i32> %v2,
<8 x i32> <i32 0, i32 1, i32 2, i32 3, i32 4, i32 5, i32 6, i32 7 > ; yields <8 x i32>
Aggregate Operations¶
LLVM supports several instructions for working with aggregate values.
‘extractvalue
’ Instruction¶
Syntax:¶
<result> = extractvalue <aggregate type> <val>, <idx>{, <idx>}*
Overview:¶
The ‘extractvalue
’ instruction extracts the value of a member field
from an aggregate value.
Arguments:¶
The first operand of an ‘extractvalue
’ instruction is a value of
struct or array type. The other operands are
constant indices to specify which value to extract in a similar manner
as indices in a ‘getelementptr
’ instruction.
The major differences to getelementptr
indexing are:
Since the value being indexed is not a pointer, the first index is omitted and assumed to be zero.
At least one index must be specified.
Not only struct indices but also array indices must be in bounds.
Semantics:¶
The result is the value at the position in the aggregate specified by the index operands.
Example:¶
<result> = extractvalue {i32, float} %agg, 0 ; yields i32
‘insertvalue
’ Instruction¶
Syntax:¶
<result> = insertvalue <aggregate type> <val>, <ty> <elt>, <idx>{, <idx>}* ; yields <aggregate type>
Overview:¶
The ‘insertvalue
’ instruction inserts a value into a member field in
an aggregate value.
Arguments:¶
The first operand of an ‘insertvalue
’ instruction is a value of
struct or array type. The second operand is
a first-class value to insert. The following operands are constant
indices indicating the position at which to insert the value in a
similar manner as indices in a ‘extractvalue
’ instruction. The value
to insert must have the same type as the value identified by the
indices.
Semantics:¶
The result is an aggregate of the same type as val
. Its value is
that of val
except that the value at the position specified by the
indices is that of elt
.
Example:¶
%agg1 = insertvalue {i32, float} undef, i32 1, 0 ; yields {i32 1, float undef}
%agg2 = insertvalue {i32, float} %agg1, float %val, 1 ; yields {i32 1, float %val}
%agg3 = insertvalue {i32, {float}} undef, float %val, 1, 0 ; yields {i32 undef, {float %val}}
Memory Access and Addressing Operations¶
A key design point of an SSA-based representation is how it represents memory. In LLVM, no memory locations are in SSA form, which makes things very simple. This section describes how to read, write, and allocate memory in LLVM.
‘alloca
’ Instruction¶
Syntax:¶
<result> = alloca [inalloca] <type> [, <ty> <NumElements>] [, align <alignment>] [, addrspace(<num>)] ; yields type addrspace(num)*:result
Overview:¶
The ‘alloca
’ instruction allocates memory on the stack frame of the
currently executing function, to be automatically released when this
function returns to its caller. If the address space is not explicitly
specified, the object is allocated in the alloca address space from the
datalayout string.
Arguments:¶
The ‘alloca
’ instruction allocates sizeof(<type>)*NumElements
bytes of memory on the runtime stack, returning a pointer of the
appropriate type to the program. If “NumElements” is specified, it is
the number of elements allocated, otherwise “NumElements” is defaulted
to be one.
If a constant alignment is specified, the value result of the
allocation is guaranteed to be aligned to at least that boundary. The
alignment may not be greater than 1 << 32
.
The alignment is only optional when parsing textual IR; for in-memory IR, it is always present. If not specified, the target can choose to align the allocation on any convenient boundary compatible with the type.
‘type
’ may be any sized type.
Structs containing scalable vectors cannot be used in allocas unless all
fields are the same scalable vector type (e.g. {<vscale x 2 x i32>,
<vscale x 2 x i32>}
contains the same type while {<vscale x 2 x i32>,
<vscale x 2 x i64>}
doesn’t).
Semantics:¶
Memory is allocated; a pointer is returned. The allocated memory is
uninitialized, and loading from uninitialized memory produces an undefined
value. The operation itself is undefined if there is insufficient stack
space for the allocation.’alloca
’d memory is automatically released
when the function returns. The ‘alloca
’ instruction is commonly used
to represent automatic variables that must have an address available. When
the function returns (either with the ret
or resume
instructions),
the memory is reclaimed. Allocating zero bytes is legal, but the returned
pointer may not be unique. The order in which memory is allocated (ie.,
which way the stack grows) is not specified.
Note that ‘alloca
’ outside of the alloca address space from the
datalayout string is meaningful only if the
target has assigned it a semantics.
If the returned pointer is used by llvm.lifetime.start, the returned object is initially dead. See llvm.lifetime.start and llvm.lifetime.end for the precise semantics of lifetime-manipulating intrinsics.
Example:¶
%ptr = alloca i32 ; yields ptr
%ptr = alloca i32, i32 4 ; yields ptr
%ptr = alloca i32, i32 4, align 1024 ; yields ptr
%ptr = alloca i32, align 1024 ; yields ptr
‘load
’ Instruction¶
Syntax:¶
<result> = load [volatile] <ty>, ptr <pointer>[, align <alignment>][, !nontemporal !<nontemp_node>][, !invariant.load !<empty_node>][, !invariant.group !<empty_node>][, !nonnull !<empty_node>][, !dereferenceable !<deref_bytes_node>][, !dereferenceable_or_null !<deref_bytes_node>][, !align !<align_node>][, !noundef !<empty_node>]
<result> = load atomic [volatile] <ty>, ptr <pointer> [syncscope("<target-scope>")] <ordering>, align <alignment> [, !invariant.group !<empty_node>]
!<nontemp_node> = !{ i32 1 }
!<empty_node> = !{}
!<deref_bytes_node> = !{ i64 <dereferenceable_bytes> }
!<align_node> = !{ i64 <value_alignment> }
Overview:¶
The ‘load
’ instruction is used to read from memory.
Arguments:¶
The argument to the load
instruction specifies the memory address from which
to load. The type specified must be a first class type of
known size (i.e. not containing an opaque structural type). If
the load
is marked as volatile
, then the optimizer is not allowed to
modify the number or order of execution of this load
with other
volatile operations.
If the load
is marked as atomic
, it takes an extra ordering and optional syncscope("<target-scope>")
argument. The
release
and acq_rel
orderings are not valid on load
instructions.
Atomic loads produce defined results when they may see
multiple atomic stores. The type of the pointee must be an integer, pointer, or
floating-point type whose bit width is a power of two greater than or equal to
eight and less than or equal to a target-specific size limit. align
must be
explicitly specified on atomic loads. Note: if the alignment is not greater or
equal to the size of the <value> type, the atomic operation is likely to
require a lock and have poor performance. !nontemporal
does not have any
defined semantics for atomic loads.
The optional constant align
argument specifies the alignment of the
operation (that is, the alignment of the memory address). It is the
responsibility of the code emitter to ensure that the alignment information is
correct. Overestimating the alignment results in undefined behavior.
Underestimating the alignment may produce less efficient code. An alignment of
1 is always safe. The maximum possible alignment is 1 << 32
. An alignment
value higher than the size of the loaded type implies memory up to the
alignment value bytes can be safely loaded without trapping in the default
address space. Access of the high bytes can interfere with debugging tools, so
should not be accessed if the function has the sanitize_thread
or
sanitize_address
attributes.
The alignment is only optional when parsing textual IR; for in-memory IR, it is
always present. An omitted align
argument means that the operation has the
ABI alignment for the target.
The optional !nontemporal
metadata must reference a single
metadata name <nontemp_node>
corresponding to a metadata node with one
i32
entry of value 1. The existence of the !nontemporal
metadata on the instruction tells the optimizer and code generator
that this load is not expected to be reused in the cache. The code
generator may select special instructions to save cache bandwidth, such
as the MOVNT
instruction on x86.
The optional !invariant.load
metadata must reference a single
metadata name <empty_node>
corresponding to a metadata node with no
entries. If a load instruction tagged with the !invariant.load
metadata is executed, the memory location referenced by the load has
to contain the same value at all points in the program where the
memory location is dereferenceable; otherwise, the behavior is
undefined.
- The optional
!invariant.group
metadata must reference a single metadata name <empty_node>
corresponding to a metadata node with no entries. Seeinvariant.group
metadata invariant.group.
The optional !nonnull
metadata must reference a single
metadata name <empty_node>
corresponding to a metadata node with no
entries. The existence of the !nonnull
metadata on the
instruction tells the optimizer that the value loaded is known to
never be null. If the value is null at runtime, a poison value is returned
instead. This is analogous to the nonnull
attribute on parameters and
return values. This metadata can only be applied to loads of a pointer type.
The optional !dereferenceable
metadata must reference a single metadata
name <deref_bytes_node>
corresponding to a metadata node with one i64
entry.
See dereferenceable
metadata dereferenceable.
The optional !dereferenceable_or_null
metadata must reference a single
metadata name <deref_bytes_node>
corresponding to a metadata node with one
i64
entry.
See dereferenceable_or_null
metadata dereferenceable_or_null.
The optional !align
metadata must reference a single metadata name
<align_node>
corresponding to a metadata node with one i64
entry.
The existence of the !align
metadata on the instruction tells the
optimizer that the value loaded is known to be aligned to a boundary specified
by the integer value in the metadata node. The alignment must be a power of 2.
This is analogous to the ‘’align’’ attribute on parameters and return values.
This metadata can only be applied to loads of a pointer type. If the returned
value is not appropriately aligned at runtime, a poison value is returned
instead.
The optional !noundef
metadata must reference a single metadata name
<empty_node>
corresponding to a node with no entries. The existence of
!noundef
metadata on the instruction tells the optimizer that the value
loaded is known to be well defined.
If the value isn’t well defined, the behavior is undefined. If the !noundef
metadata is combined with poison-generating metadata like !nonnull
,
violation of that metadata constraint will also result in undefined behavior.
Semantics:¶
The location of memory pointed to is loaded. If the value being loaded
is of scalar type then the number of bytes read does not exceed the
minimum number of bytes needed to hold all bits of the type. For
example, loading an i24
reads at most three bytes. When loading a
value of a type like i20
with a size that is not an integral number
of bytes, the result is undefined if the value was not originally
written using a store of the same type.
If the value being loaded is of aggregate type, the bytes that correspond to
padding may be accessed but are ignored, because it is impossible to observe
padding from the loaded aggregate value.
If <pointer>
is not a well-defined value, the behavior is undefined.
Examples:¶
%ptr = alloca i32 ; yields ptr
store i32 3, ptr %ptr ; yields void
%val = load i32, ptr %ptr ; yields i32:val = i32 3
‘store
’ Instruction¶
Syntax:¶
store [volatile] <ty> <value>, ptr <pointer>[, align <alignment>][, !nontemporal !<nontemp_node>][, !invariant.group !<empty_node>] ; yields void
store atomic [volatile] <ty> <value>, ptr <pointer> [syncscope("<target-scope>")] <ordering>, align <alignment> [, !invariant.group !<empty_node>] ; yields void
!<nontemp_node> = !{ i32 1 }
!<empty_node> = !{}
Overview:¶
The ‘store
’ instruction is used to write to memory.
Arguments:¶
There are two arguments to the store
instruction: a value to store and an
address at which to store it. The type of the <pointer>
operand must be a
pointer to the first class type of the <value>
operand. If the store
is marked as volatile
, then the optimizer is not
allowed to modify the number or order of execution of this store
with other
volatile operations. Only values of first class types of known size (i.e. not containing an opaque
structural type) can be stored.
If the store
is marked as atomic
, it takes an extra ordering and optional syncscope("<target-scope>")
argument. The
acquire
and acq_rel
orderings aren’t valid on store
instructions.
Atomic loads produce defined results when they may see
multiple atomic stores. The type of the pointee must be an integer, pointer, or
floating-point type whose bit width is a power of two greater than or equal to
eight and less than or equal to a target-specific size limit. align
must be
explicitly specified on atomic stores. Note: if the alignment is not greater or
equal to the size of the <value> type, the atomic operation is likely to
require a lock and have poor performance. !nontemporal
does not have any
defined semantics for atomic stores.
The optional constant align
argument specifies the alignment of the
operation (that is, the alignment of the memory address). It is the
responsibility of the code emitter to ensure that the alignment information is
correct. Overestimating the alignment results in undefined behavior.
Underestimating the alignment may produce less efficient code. An alignment of
1 is always safe. The maximum possible alignment is 1 << 32
. An alignment
value higher than the size of the loaded type implies memory up to the
alignment value bytes can be safely loaded without trapping in the default
address space. Access of the high bytes can interfere with debugging tools, so
should not be accessed if the function has the sanitize_thread
or
sanitize_address
attributes.
The alignment is only optional when parsing textual IR; for in-memory IR, it is
always present. An omitted align
argument means that the operation has the
ABI alignment for the target.
The optional !nontemporal
metadata must reference a single metadata
name <nontemp_node>
corresponding to a metadata node with one i32
entry
of value 1. The existence of the !nontemporal
metadata on the instruction
tells the optimizer and code generator that this load is not expected to
be reused in the cache. The code generator may select special
instructions to save cache bandwidth, such as the MOVNT
instruction on
x86.
The optional !invariant.group
metadata must reference a
single metadata name <empty_node>
. See invariant.group
metadata.
Semantics:¶
The contents of memory are updated to contain <value>
at the
location specified by the <pointer>
operand. If <value>
is
of scalar type then the number of bytes written does not exceed the
minimum number of bytes needed to hold all bits of the type. For
example, storing an i24
writes at most three bytes. When writing a
value of a type like i20
with a size that is not an integral number
of bytes, it is unspecified what happens to the extra bits that do not
belong to the type, but they will typically be overwritten.
If <value>
is of aggregate type, padding is filled with
undef.
If <pointer>
is not a well-defined value, the behavior is undefined.
Example:¶
%ptr = alloca i32 ; yields ptr
store i32 3, ptr %ptr ; yields void
%val = load i32, ptr %ptr ; yields i32:val = i32 3
‘fence
’ Instruction¶
Syntax:¶
fence [syncscope("<target-scope>")] <ordering> ; yields void
Overview:¶
The ‘fence
’ instruction is used to introduce happens-before edges
between operations.
Arguments:¶
‘<