2020-2-capstone-design2 / 2015104175

On every specification that takes a ``:``, specifying the
```` alignment is optional. If omitted, the preceding ``:``
should be omitted too and ```` will be equal to ````.

When constructing the data layout for a given target, LLVM starts with a
default set of specifications which are then (possibly) overridden by
the specifications in the ``datalayout`` keyword. The default
specifications are given in this list:

- ``E`` - big endian
- ``p:64:64:64`` - 64-bit pointers with 64-bit alignment.
- ``p[n]:64:64:64`` - Other address spaces are assumed to be the
same as the default address space.
- ``S0`` - natural stack alignment is unspecified
- ``i1:8:8`` - i1 is 8-bit (byte) aligned
- ``i8:8:8`` - i8 is 8-bit (byte) aligned
- ``i16:16:16`` - i16 is 16-bit aligned
- ``i32:32:32`` - i32 is 32-bit aligned
- ``i64:32:64`` - i64 has ABI alignment of 32-bits but preferred
alignment of 64-bits
- ``f16:16:16`` - half is 16-bit aligned
- ``f32:32:32`` - float is 32-bit aligned
- ``f64:64:64`` - double is 64-bit aligned
- ``f128:128:128`` - quad is 128-bit aligned
- ``v64:64:64`` - 64-bit vector is 64-bit aligned
- ``v128:128:128`` - 128-bit vector is 128-bit aligned
- ``a:0:64`` - aggregates are 64-bit aligned

When LLVM is determining the alignment for a given type, it uses the
following rules:

#. If the type sought is an exact match for one of the specifications,
that specification is used.
#. If no match is found, and the type sought is an integer type, then
the smallest integer type that is larger than the bitwidth of the
sought type is used. If none of the specifications are larger than
the bitwidth then the largest integer type is used. For example,
given the default specifications above, the i7 type will use the
alignment of i8 (next largest) while both i65 and i256 will use the
alignment of i64 (largest specified).
#. If no match is found, and the type sought is a vector type, then the
largest vector type that is smaller than the sought vector type will
be used as a fall back. This happens because can be
implemented in terms of 64 , for example.

The function of the data layout string may not be what you expect.
Notably, this is not a specification from the frontend of what alignment
the code generator should use.

Instead, if specified, the target data layout is required to match what
the ultimate *code generator* expects. This string is used by the
mid-level optimizers to improve code, and this only works if it matches
what the ultimate code generator uses. There is no way to generate IR
that does not embed this target-specific detail into the IR. If you
don't specify the string, the default specifications will be used to
generate a Data Layout and the optimization phases will operate
accordingly and introduce target specificity into the IR with respect to
these default specifications.

.. _langref_triple:

Target Triple
-------------

A module may specify a target triple string that describes the target
host. The syntax for the target triple is simply:

.. code-block:: llvm

target triple = "x86_64-apple-macosx10.7.0"

The *target triple* string consists of a series of identifiers delimited
by the minus sign character ('-'). The canonical forms are:

::

ARCHITECTURE-VENDOR-OPERATING_SYSTEM
ARCHITECTURE-VENDOR-OPERATING_SYSTEM-ENVIRONMENT

This information is passed along to the backend so that it generates
code for the proper architecture. It's possible to override this on the
command line with the ``-mtriple`` command line option.

.. _pointeraliasing:

Pointer Aliasing Rules
----------------------

Any memory access must be done through a pointer value associated with
an address range of the memory access, otherwise the behavior is
undefined. Pointer values are associated with address ranges according
to the following rules:

- A pointer value is associated with the addresses associated with any
value it is *based* on.
- An address of a global variable is associated with the address range
of the variable's storage.
- The result value of an allocation instruction is associated with the
address range of the allocated storage.
- A null pointer in the default address-space is associated with no
address.
- An :ref:`undef value ` in *any* address-space is
associated with no address.
- An integer constant other than zero or a pointer value returned from
a function not defined within LLVM may be associated with address
ranges allocated through mechanisms other than those provided by
LLVM. Such ranges shall not overlap with any ranges of addresses
allocated by mechanisms provided by LLVM.

A pointer value is *based* on another pointer value according to the
following rules:

- A pointer value formed from a scalar ``getelementptr`` operation is *based* on
the pointer-typed operand of the ``getelementptr``.
- The pointer in lane *l* of the result of a vector ``getelementptr`` operation
is *based* on the pointer in lane *l* of the vector-of-pointers-typed operand
of the ``getelementptr``.
- The result value of a ``bitcast`` is *based* on the operand of the
``bitcast``.
- A pointer value formed by an ``inttoptr`` is *based* on all pointer
values that contribute (directly or indirectly) to the computation of
the pointer's value.
- The "*based* on" relationship is transitive.

Note that this definition of *"based"* is intentionally similar to the
definition of *"based"* in C99, though it is slightly weaker.

LLVM IR does not associate types with memory. The result type of a
``load`` merely indicates the size and alignment of the memory from
which to load, as well as the interpretation of the value. The first
operand type of a ``store`` similarly only indicates the size and
alignment of the store.

Consequently, type-based alias analysis, aka TBAA, aka
``-fstrict-aliasing``, is not applicable to general unadorned LLVM IR.
:ref:`Metadata ` may be used to encode additional information
which specialized optimization passes may use to implement type-based
alias analysis.

.. _volatile:

Volatile Memory Accesses
------------------------

Certain memory accesses, such as :ref:`load `'s,
:ref:`store `'s, and :ref:`llvm.memcpy `'s may be
marked ``volatile``. The optimizers must not change the number of
volatile operations or change their order of execution relative to other
volatile operations. The optimizers *may* change the order of volatile
operations relative to non-volatile operations. This is not Java's
"volatile" and has no cross-thread synchronization behavior.

A volatile load or store may have additional target-specific semantics.
Any volatile operation can have side effects, and any volatile operation
can read and/or modify state which is not accessible via a regular load
or store in this module. Volatile operations may use addresses which do
not point to memory (like MMIO registers). This means the compiler may
not use a volatile operation to prove a non-volatile access to that
address has defined behavior.

The allowed side-effects for volatile accesses are limited. If a
non-volatile store to a given address would be legal, a volatile
operation may modify the memory at that address. A volatile operation
may not modify any other memory accessible by the module being compiled.
A volatile operation may not call any code in the current module.

The compiler may assume execution will continue after a volatile operation,
so operations which modify memory or may have undefined behavior can be
hoisted past a volatile operation.

IR-level volatile loads and stores cannot safely be optimized into llvm.memcpy
or llvm.memmove intrinsics even when those intrinsics are flagged volatile.
Likewise, the backend should never split or merge target-legal volatile
load/store instructions. Similarly, IR-level volatile loads and stores cannot
change from integer to floating-point or vice versa.

.. admonition:: Rationale

Platforms may rely on volatile loads and stores of natively supported
data width to be executed as single instruction. For example, in C
this holds for an l-value of volatile primitive type with native
hardware support, but not necessarily for aggregate types. The
frontend upholds these expectations, which are intentionally
unspecified in the IR. The rules above ensure that IR transformations
do not violate the frontend's contract with the language.

.. _memmodel:

Memory Model for Concurrent Operations
--------------------------------------

The LLVM IR does not define any way to start parallel threads of
execution or to register signal handlers. Nonetheless, there are
platform-specific ways to create them, and we define LLVM IR's behavior
in their presence. This model is inspired by the C++0x memory model.

For a more informal introduction to this model, see the :doc:`Atomics`.

We define a *happens-before* partial order as the least partial order
that

- Is a superset of single-thread program order, and
- When a *synchronizes-with* ``b``, includes an edge from ``a`` to
``b``. *Synchronizes-with* pairs are introduced by platform-specific
techniques, like pthread locks, thread creation, thread joining,
etc., and by atomic instructions. (See also :ref:`Atomic Memory Ordering
Constraints `).

Note that program order does not introduce *happens-before* edges
between a thread and signals executing inside that thread.

Every (defined) read operation (load instructions, memcpy, atomic
loads/read-modify-writes, etc.) R reads a series of bytes written by
(defined) write operations (store instructions, atomic
stores/read-modify-writes, memcpy, etc.). For the purposes of this
section, initialized globals are considered to have a write of the
initializer which is atomic and happens before any other read or write
of the memory in question. For each byte of a read R, R\ :sub:`byte`
may see any write to the same byte, except:

- If write\ :sub:`1` happens before write\ :sub:`2`, and
write\ :sub:`2` happens before R\ :sub:`byte`, then
R\ :sub:`byte` does not see write\ :sub:`1`.
- If R\ :sub:`byte` happens before write\ :sub:`3`, then
R\ :sub:`byte` does not see write\ :sub:`3`.

Given that definition, R\ :sub:`byte` is defined as follows:

- If R is volatile, the result is target-dependent. (Volatile is
supposed to give guarantees which can support ``sig_atomic_t`` in
C/C++, and may be used for accesses to addresses that do not behave
like normal memory. It does not generally provide cross-thread
synchronization.)
- Otherwise, if there is no write to the same byte that happens before
R\ :sub:`byte`, R\ :sub:`byte` returns ``undef`` for that byte.
- Otherwise, if R\ :sub:`byte` may see exactly one write,
R\ :sub:`byte` returns the value written by that write.
- Otherwise, if R is atomic, and all the writes R\ :sub:`byte` may
see are atomic, it chooses one of the values written. See the :ref:`Atomic
Memory Ordering Constraints ` section for additional
constraints on how the choice is made.
- Otherwise R\ :sub:`byte` returns ``undef``.

R returns the value composed of the series of bytes it read. This
implies that some bytes within the value may be ``undef`` **without**
the entire value being ``undef``. Note that this only defines the
semantics of the operation; it doesn't mean that targets will emit more
than one instruction to read the series of bytes.

Note that in cases where none of the atomic intrinsics are used, this
model places only one restriction on IR transformations on top of what
is required for single-threaded execution: introducing a store to a byte
which might not otherwise be stored is not allowed in general.
(Specifically, in the case where another thread might write to and read
from an address, introducing a store can change a load that may see
exactly one write into a load that may see multiple writes.)

.. _ordering:

Atomic Memory Ordering Constraints
----------------------------------

Atomic instructions (:ref:`cmpxchg `,
:ref:`atomicrmw `, :ref:`fence `,
:ref:`atomic load `, and :ref:`atomic store `) take
ordering parameters that determine which other atomic instructions on
the same address they *synchronize with*. These semantics are borrowed
from Java and C++0x, but are somewhat more colloquial. If these
descriptions aren't precise enough, check those specs (see spec
references in the :doc:`atomics guide `).
:ref:`fence ` instructions treat these orderings somewhat
differently since they don't take an address. See that instruction's
documentation for details.

For a simpler introduction to the ordering constraints, see the
:doc:`Atomics`.

``unordered``
The set of values that can be read is governed by the happens-before
partial order. A value cannot be read unless some operation wrote
it. This is intended to provide a guarantee strong enough to model
Java's non-volatile shared variables. This ordering cannot be
specified for read-modify-write operations; it is not strong enough
to make them atomic in any interesting way.
``monotonic``
In addition to the guarantees of ``unordered``, there is a single
total order for modifications by ``monotonic`` operations on each
address. All modification orders must be compatible with the
happens-before order. There is no guarantee that the modification
orders can be combined to a global total order for the whole program
(and this often will not be possible). The read in an atomic
read-modify-write operation (:ref:`cmpxchg ` and
:ref:`atomicrmw `) reads the value in the modification
order immediately before the value it writes. If one atomic read
happens before another atomic read of the same address, the later
read must see the same value or a later value in the address's
modification order. This disallows reordering of ``monotonic`` (or
stronger) operations on the same address. If an address is written
``monotonic``-ally by one thread, and other threads ``monotonic``-ally
read that address repeatedly, the other threads must eventually see
the write. This corresponds to the C++0x/C1x
``memory_order_relaxed``.
``acquire``
In addition to the guarantees of ``monotonic``, a
*synchronizes-with* edge may be formed with a ``release`` operation.
This is intended to model C++'s ``memory_order_acquire``.
``release``
In addition to the guarantees of ``monotonic``, if this operation
writes a value which is subsequently read by an ``acquire``
operation, it *synchronizes-with* that operation. (This isn't a
complete description; see the C++0x definition of a release
sequence.) This corresponds to the C++0x/C1x
``memory_order_release``.
``acq_rel`` (acquire+release)
Acts as both an ``acquire`` and ``release`` operation on its
address. This corresponds to the C++0x/C1x ``memory_order_acq_rel``.
``seq_cst`` (sequentially consistent)
In addition to the guarantees of ``acq_rel`` (``acquire`` for an
operation that only reads, ``release`` for an operation that only
writes), there is a global total order on all
sequentially-consistent operations on all addresses, which is
consistent with the *happens-before* partial order and with the
modification orders of all the affected addresses. Each
sequentially-consistent read sees the last preceding write to the
same address in this global order. This corresponds to the C++0x/C1x
``memory_order_seq_cst`` and Java volatile.

.. _syncscope:

If an atomic operation is marked ``syncscope("singlethread")``, it only
*synchronizes with* and only participates in the seq\_cst total orderings of
other operations running in the same thread (for example, in signal handlers).

If an atomic operation is marked ``syncscope("")``, where
```` is a target specific synchronization scope, then it is target
dependent if it *synchronizes with* and participates in the seq\_cst total
orderings of other operations.

Otherwise, an atomic operation that is not marked ``syncscope("singlethread")``
or ``syncscope("")`` *synchronizes with* and participates in the
seq\_cst total orderings of other operations that are not marked
``syncscope("singlethread")`` or ``syncscope("")``.

.. _floatenv:

Floating-Point Environment
--------------------------

The default LLVM floating-point environment assumes that floating-point
instructions do not have side effects. Results assume the round-to-nearest
rounding mode. No floating-point exception state is maintained in this
environment. Therefore, there is no attempt to create or preserve invalid
operation (SNaN) or division-by-zero exceptions.

The benefit of this exception-free assumption is that floating-point
operations may be speculated freely without any other fast-math relaxations
to the floating-point model.

Code that requires different behavior than this should use the
:ref:`Constrained Floating-Point Intrinsics `.

.. _fastmath:

Fast-Math Flags
---------------

LLVM IR floating-point operations (:ref:`fneg `, :ref:`fadd `,
:ref:`fsub `, :ref:`fmul `, :ref:`fdiv `,
:ref:`frem `, :ref:`fcmp `), :ref:`phi `,
:ref:`select ` and :ref:`call `
may use the following flags to enable otherwise unsafe
floating-point transformations.

``nnan``
No NaNs - Allow optimizations to assume the arguments and result are not
NaN. If an argument is a nan, or the result would be a nan, it produces
a :ref:`poison value ` instead.

``ninf``
No Infs - Allow optimizations to assume the arguments and result are not
+/-Inf. If an argument is +/-Inf, or the result would be +/-Inf, it
produces a :ref:`poison value ` instead.

``nsz``
No Signed Zeros - Allow optimizations to treat the sign of a zero
argument or result as insignificant. This does not imply that -0.0
is poison and/or guaranteed to not exist in the operation.

``arcp``
Allow Reciprocal - Allow optimizations to use the reciprocal of an
argument rather than perform division.

``contract``
Allow floating-point contraction (e.g. fusing a multiply followed by an
addition into a fused multiply-and-add). This does not enable reassociating
to form arbitrary contractions. For example, ``(a*b) + (c*d) + e`` can not
be transformed into ``(a*b) + ((c*d) + e)`` to create two fma operations.

``afn``
Approximate functions - Allow substitution of approximate calculations for
functions (sin, log, sqrt, etc). See floating-point intrinsic definitions
for places where this can apply to LLVM's intrinsic math functions.

``reassoc``
Allow reassociation transformations for floating-point instructions.
This may dramatically change results in floating-point.

``fast``
This flag implies all of the others.

.. _uselistorder:

Use-list Order Directives
-------------------------

Use-list directives encode the in-memory order of each use-list, allowing the
order to be recreated. ```` is a comma-separated list of
indexes that are assigned to the referenced value's uses. The referenced
value's use-list is immediately sorted by these indexes.

Use-list directives may appear at function scope or global scope. They are not
instructions, and have no effect on the semantics of the IR. When they're at
function scope, they must appear after the terminator of the final basic block.

If basic blocks have their address taken via ``blockaddress()`` expressions,
``uselistorder_bb`` can be used to reorder their use-lists from outside their
function's scope.

:Syntax:

::

uselistorder , { }
uselistorder_bb @function, %block { }

:Examples:

::

define void @foo(i32 %arg1, i32 %arg2) {
entry:
; ... instructions ...
bb:
; ... instructions ...

; At function scope.
uselistorder i32 %arg1, { 1, 0, 2 }
uselistorder label %bb, { 1, 0 }
}

; At global scope.
uselistorder i32* @global, { 1, 2, 0 }
uselistorder i32 7, { 1, 0 }
uselistorder i32 (i32) @bar, { 1, 0 }
uselistorder_bb @foo, %bb, { 5, 1, 3, 2, 0, 4 }

.. _source_filename:

Source Filename
---------------

The *source filename* string is set to the original module identifier,
which will be the name of the compiled source file when compiling from
source through the clang front end, for example. It is then preserved through
the IR and bitcode.

This is currently necessary to generate a consistent unique global
identifier for local functions used in profile data, which prepends the
source file name to the local function name.

The syntax for the source file name is simply:

.. code-block:: text

source_filename = "/path/to/source.c"

.. _typesystem:

Type System
===========

The LLVM type system is one of the most important features of the
intermediate representation. Being typed enables a number of
optimizations to be performed on the intermediate representation
directly, without having to do extra analyses on the side before the
transformation. A strong type system makes it easier to read the
generated code and enables novel analyses and transformations that are
not feasible to perform on normal three address code representations.

.. _t_void:

Void Type
---------

:Overview:

The void type does not represent any value and has no size.

:Syntax:

::

void

.. _t_function:

Function Type
-------------

:Overview:

The function type can be thought of as a function signature. It consists of a
return type and a list of formal parameter types. The return type of a function
type is a void type or first class type --- except for :ref:`label `
and :ref:`metadata ` types.

:Syntax:

::

()

...where '````' is a comma-separated list of type
specifiers. Optionally, the parameter list may include a type ``...``, which
indicates that the function takes a variable number of arguments. Variable
argument functions can access their arguments with the :ref:`variable argument
handling intrinsic ` functions. '````' is any type
except :ref:`label ` and :ref:`metadata `.

:Examples:

+---------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| ``i32 (i32)`` | function taking an ``i32``, returning an ``i32`` |
+---------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| ``float (i16, i32 *) *`` | :ref:`Pointer ` to a function that takes an ``i16`` and a :ref:`pointer ` to ``i32``, returning ``float``. |
+---------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| ``i32 (i8*, ...)`` | A vararg function that takes at least one :ref:`pointer ` to ``i8`` (char in C), which returns an integer. This is the signature for ``printf`` in LLVM. |
+---------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| ``{i32, i32} (i32)`` | A function taking an ``i32``, returning a :ref:`structure ` containing two ``i32`` values |
+---------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+

.. _t_firstclass:

First Class Types
-----------------

The :ref:`first class ` types are perhaps the most important.
Values of these types are the only ones which can be produced by
instructions.

.. _t_single_value:

Single Value Types
^^^^^^^^^^^^^^^^^^

These are the types that are valid in registers from CodeGen's perspective.

.. _t_integer:

Integer Type
""""""""""""

:Overview:

The integer type is a very simple type that simply specifies an
arbitrary bit width for the integer type desired. Any bit width from 1
bit to 2\ :sup:`23`\ -1 (about 8 million) can be specified.

:Syntax:

::

iN

The number of bits the integer will occupy is specified by the ``N``
value.

Examples:
*********

+----------------+------------------------------------------------+
| ``i1`` | a single-bit integer. |
+----------------+------------------------------------------------+
| ``i32`` | a 32-bit integer. |
+----------------+------------------------------------------------+
| ``i1942652`` | a really big integer of over 1 million bits. |
+----------------+------------------------------------------------+

.. _t_floating:

Floating-Point Types
""""""""""""""""""""

.. list-table::
:header-rows: 1

* - Type
- Description

* - ``half``
- 16-bit floating-point value

* - ``bfloat``
- 16-bit "brain" floating-point value (7-bit significand). Provides the
same number of exponent bits as ``float``, so that it matches its dynamic
range, but with greatly reduced precision. Used in Intel's AVX-512 BF16
extensions and Arm's ARMv8.6-A extensions, among others.

* - ``float``
- 32-bit floating-point value

* - ``double``
- 64-bit floating-point value

* - ``fp128``
- 128-bit floating-point value (112-bit significand)

* - ``x86_fp80``
- 80-bit floating-point value (X87)

* - ``ppc_fp128``
- 128-bit floating-point value (two 64-bits)

The binary format of half, float, double, and fp128 correspond to the
IEEE-754-2008 specifications for binary16, binary32, binary64, and binary128
respectively.

X86_mmx Type
""""""""""""

:Overview:

The x86_mmx type represents a value held in an MMX register on an x86
machine. The operations allowed on it are quite limited: parameters and
return values, load and store, and bitcast. User-specified MMX
instructions are represented as intrinsic or asm calls with arguments
and/or results of this type. There are no arrays, vectors or constants
of this type.

:Syntax:

::

x86_mmx

.. _t_pointer:

Pointer Type
""""""""""""

:Overview:

The pointer type is used to specify memory locations. Pointers are
commonly used to reference objects in memory.

Pointer types may have an optional address space attribute defining the
numbered address space where the pointed-to object resides. The default
address space is number zero. The semantics of non-zero address spaces
are target-specific.

Note that LLVM does not permit pointers to void (``void*``) nor does it
permit pointers to labels (``label*``). Use ``i8*`` instead.

:Syntax:

::

*

:Examples:

+-------------------------+--------------------------------------------------------------------------------------------------------------+
| ``[4 x i32]*`` | A :ref:`pointer ` to :ref:`array ` of four ``i32`` values. |
+-------------------------+--------------------------------------------------------------------------------------------------------------+
| ``i32 (i32*) *`` | A :ref:`pointer ` to a :ref:`function ` that takes an ``i32*``, returning an ``i32``. |
+-------------------------+--------------------------------------------------------------------------------------------------------------+
| ``i32 addrspace(5)*`` | A :ref:`pointer ` to an ``i32`` value that resides in address space #5. |
+-------------------------+--------------------------------------------------------------------------------------------------------------+

.. _t_vector:

Vector Type
"""""""""""

:Overview:

A vector type is a simple derived type that represents a vector of
elements. Vector types are used when multiple primitive data are
operated in parallel using a single instruction (SIMD). A vector type
requires a size (number of elements), an underlying primitive data type,
and a scalable property to represent vectors where the exact hardware
vector length is unknown at compile time. Vector types are considered
:ref:`first class `.

:Syntax:

::

< x > ; Fixed-length vector
< vscale x x > ; Scalable vector

The number of elements is a constant integer value larger than 0;
elementtype may be any integer, floating-point or pointer type. Vectors
of size zero are not allowed. For scalable vectors, the total number of
elements is a constant multiple (called vscale) of the specified number
of elements; vscale is a positive integer that is unknown at compile time
and the same hardware-dependent constant for all scalable vectors at run
time. The size of a specific scalable vector type is thus constant within
IR, even if the exact size in bytes cannot be determined until run time.

:Examples:

+------------------------+----------------------------------------------------+
| ```` | Vector of 4 32-bit integer values. |
+------------------------+----------------------------------------------------+
| ```` | Vector of 8 32-bit floating-point values. |
+------------------------+----------------------------------------------------+
| ```` | Vector of 2 64-bit integer values. |
+------------------------+----------------------------------------------------+
| ```` | Vector of 4 pointers to 64-bit integer values. |
+------------------------+----------------------------------------------------+
| ```` | Vector with a multiple of 4 32-bit integer values. |
+------------------------+----------------------------------------------------+

.. _t_label:

Label Type
^^^^^^^^^^

:Overview:

The label type represents code labels.

:Syntax:

::

label

.. _t_token:

Token Type
^^^^^^^^^^

:Overview:

The token type is used when a value is associated with an instruction
but all uses of the value must not attempt to introspect or obscure it.
As such, it is not appropriate to have a :ref:`phi ` or
:ref:`select ` of type token.

:Syntax:

::

token

.. _t_metadata:

Metadata Type
^^^^^^^^^^^^^

:Overview:

The metadata type represents embedded metadata. No derived types may be
created from metadata except for :ref:`function ` arguments.

:Syntax:

::

metadata

.. _t_aggregate:

Aggregate Types
^^^^^^^^^^^^^^^

Aggregate Types are a subset of derived types that can contain multiple
member types. :ref:`Arrays ` and :ref:`structs ` are
aggregate types. :ref:`Vectors ` are not considered to be
aggregate types.

.. _t_array:

Array Type
""""""""""

:Overview:

The array type is a very simple derived type that arranges elements
sequentially in memory. The array type requires a size (number of
elements) and an underlying data type.

:Syntax:

::

[ x ]

The number of elements is a constant integer value; ``elementtype`` may
be any type with a size.

:Examples:

+------------------+--------------------------------------+
| ``[40 x i32]`` | Array of 40 32-bit integer values. |
+------------------+--------------------------------------+
| ``[41 x i32]`` | Array of 41 32-bit integer values. |
+------------------+--------------------------------------+
| ``[4 x i8]`` | Array of 4 8-bit integer values. |
+------------------+--------------------------------------+

Here are some examples of multidimensional arrays:

+-----------------------------+----------------------------------------------------------+
| ``[3 x [4 x i32]]`` | 3x4 array of 32-bit integer values. |
+-----------------------------+----------------------------------------------------------+
| ``[12 x [10 x float]]`` | 12x10 array of single precision floating-point values. |
+-----------------------------+----------------------------------------------------------+
| ``[2 x [3 x [4 x i16]]]`` | 2x3x4 array of 16-bit integer values. |
+-----------------------------+----------------------------------------------------------+

There is no restriction on indexing beyond the end of the array implied
by a static type (though there are restrictions on indexing beyond the
bounds of an allocated object in some cases). This means that
single-dimension 'variable sized array' addressing can be implemented in
LLVM with a zero length array type. An implementation of 'pascal style
arrays' in LLVM could use the type "``{ i32, [0 x float]}``", for
example.

.. _t_struct:

Structure Type
""""""""""""""

:Overview:

The structure type is used to represent a collection of data members
together in memory. The elements of a structure may be any type that has
a size.

Structures in memory are accessed using '``load``' and '``store``' by
getting a pointer to a field with the '``getelementptr``' instruction.
Structures in registers are accessed using the '``extractvalue``' and
'``insertvalue``' instructions.

Structures may optionally be "packed" structures, which indicate that
the alignment of the struct is one byte, and that there is no padding
between the elements. In non-packed structs, padding between field types
is inserted as defined by the DataLayout string in the module, which is
required to match what the underlying code generator expects.

Structures can either be "literal" or "identified". A literal structure
is defined inline with other types (e.g. ``{i32, i32}*``) whereas
identified types are always defined at the top level with a name.
Literal types are uniqued by their contents and can never be recursive
or opaque since there is no way to write one. Identified types can be
recursive, can be opaqued, and are never uniqued.

:Syntax:

::

%T1 = type { } ; Identified normal struct type
%T2 = type }> ; Identified packed struct type

:Examples:

+------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| ``{ i32, i32, i32 }`` | A triple of three ``i32`` values |
+------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| ``{ float, i32 (i32) * }`` | A pair, where the first element is a ``float`` and the second element is a :ref:`pointer ` to a :ref:`function ` that takes an ``i32``, returning an ``i32``. |
+------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| ```` | A packed struct known to be 5 bytes in size. |
+------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

.. _t_opaque:

Opaque Structure Types
""""""""""""""""""""""

:Overview:

Opaque structure types are used to represent named structure types that
do not have a body specified. This corresponds (for example) to the C
notion of a forward declared structure.

:Syntax:

::

%X = type opaque
%52 = type opaque

:Examples:

+--------------+-------------------+
| ``opaque`` | An opaque type. |
+--------------+-------------------+

.. _constants:

Constants
=========

LLVM has several different basic types of constants. This section
describes them all and their syntax.

Simple Constants
----------------

**Boolean constants**
The two strings '``true``' and '``false``' are both valid constants
of the ``i1`` type.
**Integer constants**
Standard integers (such as '4') are constants of the
:ref:`integer ` type. Negative numbers may be used with
integer types.
**Floating-point constants**
Floating-point constants use standard decimal notation (e.g.
123.421), exponential notation (e.g. 1.23421e+2), or a more precise
hexadecimal notation (see below). The assembler requires the exact
decimal value of a floating-point constant. For example, the
assembler accepts 1.25 but rejects 1.3 because 1.3 is a repeating
decimal in binary. Floating-point constants must have a
:ref:`floating-point ` type.
**Null pointer constants**
The identifier '``null``' is recognized as a null pointer constant
and must be of :ref:`pointer type `.
**Token constants**
The identifier '``none``' is recognized as an empty token constant
and must be of :ref:`token type `.

The one non-intuitive notation for constants is the hexadecimal form of
floating-point constants. For example, the form
'``double 0x432ff973cafa8000``' is equivalent to (but harder to read
than) '``double 4.5e+15``'. The only time hexadecimal floating-point
constants are required (and the only time that they are generated by the
disassembler) is when a floating-point constant must be emitted but it
cannot be represented as a decimal floating-point number in a reasonable
number of digits. For example, NaN's, infinities, and other special
values are represented in their IEEE hexadecimal format so that assembly
and disassembly do not cause any bits to change in the constants.

When using the hexadecimal form, constants of types bfloat, half, float, and
double are represented using the 16-digit form shown above (which matches the
IEEE754 representation for double); bfloat, half and float values must, however,
be exactly representable as bfloat, IEEE 754 half, and IEEE 754 single
precision respectively. Hexadecimal format is always used for long double, and
there are three forms of long double. The 80-bit format used by x86 is
represented as ``0xK`` followed by 20 hexadecimal digits. The 128-bit format
used by PowerPC (two adjacent doubles) is represented by ``0xM`` followed by 32
hexadecimal digits. The IEEE 128-bit format is represented by ``0xL`` followed
by 32 hexadecimal digits. Long doubles will only work if they match the long
double format on your target. The IEEE 16-bit format (half precision) is
represented by ``0xH`` followed by 4 hexadecimal digits. The bfloat 16-bit
format is represented by ``0xR`` followed by 4 hexadecimal digits. All
hexadecimal formats are big-endian (sign bit at the left).

There are no constants of type x86_mmx.

.. _complexconstants:

Complex Constants
-----------------

Complex constants are a (potentially recursive) combination of simple
constants and smaller complex constants.

**Structure constants**
Structure constants are represented with notation similar to
structure type definitions (a comma separated list of elements,
surrounded by braces (``{}``)). For example:
"``{ i32 4, float 17.0, i32* @G }``", where "``@G``" is declared as
"``@G = external global i32``". Structure constants must have
:ref:`structure type `, and the number and types of elements
must match those specified by the type.
**Array constants**
Array constants are represented with notation similar to array type
definitions (a comma separated list of elements, surrounded by
square brackets (``[]``)). For example:
"``[ i32 42, i32 11, i32 74 ]``". Array constants must have
:ref:`array type `, and the number and types of elements must
match those specified by the type. As a special case, character array
constants may also be represented as a double-quoted string using the ``c``
prefix. For example: "``c"Hello World\0A\00"``".
**Vector constants**
Vector constants are represented with notation similar to vector
type definitions (a comma separated list of elements, surrounded by
less-than/greater-than's (``<>``)). For example:
"``< i32 42, i32 11, i32 74, i32 100 >``". Vector constants
must have :ref:`vector type `, and the number and types of
elements must match those specified by the type.
**Zero initialization**
The string '``zeroinitializer``' can be used to zero initialize a
value to zero of *any* type, including scalar and
:ref:`aggregate ` types. This is often used to avoid
having to print large zero initializers (e.g. for large arrays) and
is always exactly equivalent to using explicit zero initializers.
**Metadata node**
A metadata node is a constant tuple without types. For example:
"``!{!0, !{!2, !0}, !"test"}``". Metadata can reference constant values,
for example: "``!{!0, i32 0, i8* @global, i64 (i64)* @function, !"str"}``".
Unlike other typed constants that are meant to be interpreted as part of
the instruction stream, metadata is a place to attach additional
information such as debug info.

Global Variable and Function Addresses
--------------------------------------

The addresses of :ref:`global variables ` and
:ref:`functions ` are always implicitly valid
(link-time) constants. These constants are explicitly referenced when
the :ref:`identifier for the global ` is used and always have
:ref:`pointer ` type. For example, the following is a legal LLVM
file:

.. code-block:: llvm

@X = global i32 17
@Y = global i32 42
@Z = global [2 x i32*] [ i32* @X, i32* @Y ]

.. _undefvalues:

Undefined Values
----------------

The string '``undef``' can be used anywhere a constant is expected, and
indicates that the user of the value may receive an unspecified
bit-pattern. Undefined values may be of any type (other than '``label``'
or '``void``') and be used anywhere a constant is permitted.

Undefined values are useful because they indicate to the compiler that
the program is well defined no matter what value is used. This gives the
compiler more freedom to optimize. Here are some examples of
(potentially surprising) transformations that are valid (in pseudo IR):

.. code-block:: llvm

%A = add %X, undef
%B = sub %X, undef
%C = xor %X, undef
Safe:
%A = undef
%B = undef
%C = undef

This is safe because all of the output bits are affected by the undef
bits. Any output bit can have a zero or one depending on the input bits.

.. code-block:: llvm

%A = or %X, undef
%B = and %X, undef
Safe:
%A = -1
%B = 0
Safe:
%A = %X ;; By choosing undef as 0
%B = %X ;; By choosing undef as -1
Unsafe:
%A = undef
%B = undef

These logical operations have bits that are not always affected by the
input. For example, if ``%X`` has a zero bit, then the output of the
'``and``' operation will always be a zero for that bit, no matter what
the corresponding bit from the '``undef``' is. As such, it is unsafe to
optimize or assume that the result of the '``and``' is '``undef``'.
However, it is safe to assume that all bits of the '``undef``' could be
0, and optimize the '``and``' to 0. Likewise, it is safe to assume that
all the bits of the '``undef``' operand to the '``or``' could be set,
allowing the '``or``' to be folded to -1.

.. code-block:: llvm

%A = select undef, %X, %Y
%B = select undef, 42, %Y
%C = select %X, %Y, undef
Safe:
%A = %X (or %Y)
%B = 42 (or %Y)
%C = %Y
Unsafe:
%A = undef
%B = undef
%C = undef

This set of examples shows that undefined '``select``' (and conditional
branch) conditions can go *either way*, but they have to come from one
of the two operands. In the ``%A`` example, if ``%X`` and ``%Y`` were
both known to have a clear low bit, then ``%A`` would have to have a
cleared low bit. However, in the ``%C`` example, the optimizer is
allowed to assume that the '``undef``' operand could be the same as
``%Y``, allowing the whole '``select``' to be eliminated.

.. code-block:: text

%A = xor undef, undef

%B = undef
%C = xor %B, %B

%D = undef
%E = icmp slt %D, 4
%F = icmp gte %D, 4

Safe:
%A = undef
%B = undef
%C = undef
%D = undef
%E = undef
%F = undef

This example points out that two '``undef``' operands are not
necessarily the same. This can be surprising to people (and also matches
C semantics) where they assume that "``X^X``" is always zero, even if
``X`` is undefined. This isn't true for a number of reasons, but the
short answer is that an '``undef``' "variable" can arbitrarily change
its value over its "live range". This is true because the variable
doesn't actually *have a live range*. Instead, the value is logically
read from arbitrary registers that happen to be around when needed, so
the value is not necessarily consistent over time. In fact, ``%A`` and
``%C`` need to have the same semantics or the core LLVM "replace all
uses with" concept would not hold.

To ensure all uses of a given register observe the same value (even if
'``undef``'), the :ref:`freeze instruction ` can be used.
A value is frozen if its uses see the same value.

.. code-block:: llvm

%A = sdiv undef, %X
%B = sdiv %X, undef
Safe:
%A = 0
b: unreachable

These examples show the crucial difference between an *undefined value*
and *undefined behavior*. An undefined value (like '``undef``') is
allowed to have an arbitrary bit-pattern. This means that the ``%A``
operation can be constant folded to '``0``', because the '``undef``'
could be zero, and zero divided by any value is zero.
However, in the second example, we can make a more aggressive
assumption: because the ``undef`` is allowed to be an arbitrary value,
we are allowed to assume that it could be zero. Since a divide by zero
has *undefined behavior*, we are allowed to assume that the operation
does not execute at all. This allows us to delete the divide and all
code after it. Because the undefined operation "can't happen", the
optimizer can assume that it occurs in dead code.

.. code-block:: text

a: store undef -> %X
b: store %X -> undef
Safe:
a:
b: unreachable

A store *of* an undefined value can be assumed to not have any effect;
we can assume that the value is overwritten with bits that happen to
match what was already there. However, a store *to* an undefined
location could clobber arbitrary memory, therefore, it has undefined
behavior.

Branching on an undefined value is undefined behavior.
This explains optimizations that depend on branch conditions to construct
predicates, such as Correlated Value Propagation and Global Value Numbering.
In case of switch instruction, the branch condition should be frozen, otherwise
it is undefined behavior.

.. code-block:: text

Unsafe:
br undef, BB1, BB2 ; UB

%X = and i32 undef, 255
switch %X, label %ret [ .. ] ; UB

store undef, i8* %ptr
%X = load i8* %ptr ; %X is undef
switch i8 %X, label %ret [ .. ] ; UB

Safe:
%X = or i8 undef, 255 ; always 255
switch i8 %X, label %ret [ .. ] ; Well-defined

%X = freeze i1 undef
br %X, BB1, BB2 ; Well-defined (non-deterministic jump)

This is also consistent with the behavior of MemorySanitizer.
MemorySanitizer, detector of uses of uninitialized memory,
defines a branch with condition that depends on an undef value (or
certain other values, like e.g. a result of a load from heap-allocated
memory that has never been stored to) to have an externally visible
side effect. For this reason functions with *sanitize_memory*
attribute are not allowed to produce such branches "out of thin
air". More strictly, an optimization that inserts a conditional branch
is only valid if in all executions where the branch condition has at
least one undefined bit, the same branch condition is evaluated in the
input IR as well.

.. _poisonvalues:

Poison Values
-------------

In order to facilitate speculative execution, many instructions do not
invoke immediate undefined behavior when provided with illegal operands,
and return a poison value instead.

There is currently no way of representing a poison value in the IR; they
only exist when produced by operations such as :ref:`add ` with
the ``nsw`` flag.

Poison value behavior is defined in terms of value *dependence*:

- Values other than :ref:`phi ` nodes and :ref:`select `
instructions depend on their operands.
- :ref:`Phi ` nodes depend on the operand corresponding to
their dynamic predecessor basic block.
- Select instructions depend on their condition operand and their
selected operand.
- Function arguments depend on the corresponding actual argument values
in the dynamic callers of their functions.
- :ref:`Call ` instructions depend on the :ref:`ret `
instructions that dynamically transfer control back to them.
- :ref:`Invoke ` instructions depend on the
:ref:`ret `, :ref:`resume `, or exception-throwing
call instructions that dynamically transfer control back to them.
- Non-volatile loads and stores depend on the most recent stores to all
of the referenced memory addresses, following the order in the IR
(including loads and stores implied by intrinsics such as
:ref:`@llvm.memcpy `.)
- An instruction with externally visible side effects depends on the
most recent preceding instruction with externally visible side
effects, following the order in the IR. (This includes :ref:`volatile
operations `.)
- An instruction *control-depends* on a :ref:`terminator
instruction ` if the terminator instruction has
multiple successors and the instruction is always executed when
control transfers to one of the successors, and may not be executed
when control is transferred to another.
- Additionally, an instruction also *control-depends* on a terminator
instruction if the set of instructions it otherwise depends on would
be different if the terminator had transferred control to a different
successor.
- Dependence is transitive.
- Vector elements may be independently poisoned. Therefore, transforms
on instructions such as shufflevector must be careful to propagate
poison across values or elements only as allowed by the original code.

An instruction that *depends* on a poison value, produces a poison value
itself. A poison value may be relaxed into an
:ref:`undef value `, which takes an arbitrary bit-pattern.
Propagation of poison can be stopped with the
:ref:`freeze instruction `.

This means that immediate undefined behavior occurs if a poison value is
used as an instruction operand that has any values that trigger undefined
behavior. Notably this includes (but is not limited to):

- The pointer operand of a :ref:`load `, :ref:`store ` or
any other pointer dereferencing instruction (independent of address
space).
- The divisor operand of a ``udiv``, ``sdiv``, ``urem`` or ``srem``
instruction.
- The condition operand of a :ref:`br ` instruction.
- The callee operand of a :ref:`call ` or :ref:`invoke `
instruction.
- The parameter operand of a :ref:`call ` or :ref:`invoke `
instruction, when the function or invoking call site has a ``noundef``
attribute in the corresponding position.
- The operand of a :ref:`ret ` instruction if the function or invoking
call site has a `noundef` attribute in the return value position.

Here are some examples:

.. code-block:: llvm

entry:
%poison = sub nuw i32 0, 1 ; Results in a poison value.
%still_poison = and i32 %poison, 0 ; 0, but also poison.
%poison_yet_again = getelementptr i32, i32* @h, i32 %still_poison
store i32 0, i32* %poison_yet_again ; Undefined behavior due to
; store to poison.

store i32 %poison, i32* @g ; Poison value stored to memory.
%poison2 = load i32, i32* @g ; Poison value loaded back from memory.

%narrowaddr = bitcast i32* @g to i16*
%wideaddr = bitcast i32* @g to i64*
%poison3 = load i16, i16* %narrowaddr ; Returns a poison value.
%poison4 = load i64, i64* %wideaddr ; Returns a poison value.

%cmp = icmp slt i32 %poison, 0 ; Returns a poison value.
br i1 %cmp, label %end, label %end ; undefined behavior

end:

.. _blockaddress:

Addresses of Basic Blocks
-------------------------

``blockaddress(@function, %block)``

The '``blockaddress``' constant computes the address of the specified
basic block in the specified function, and always has an ``i8*`` type.
Taking the address of the entry block is illegal.

This value only has defined behavior when used as an operand to the
':ref:`indirectbr `' or ':ref:`callbr `'instruction, or
for comparisons against null. Pointer equality tests between labels addresses
results in undefined behavior --- though, again, comparison against null is ok,
and no label is equal to the null pointer. This may be passed around as an
opaque pointer sized value as long as the bits are not inspected. This
allows ``ptrtoint`` and arithmetic to be performed on these values so
long as the original value is reconstituted before the ``indirectbr`` or
``callbr`` instruction.

Finally, some targets may provide defined semantics when using the value
as the operand to an inline assembly, but that is target specific.

.. _constantexprs:

Constant Expressions
--------------------

Constant expressions are used to allow expressions involving other
constants to be used as constants. Constant expressions may be of any
:ref:`first class ` type and may involve any LLVM operation
that does not have side effects (e.g. load and call are not supported).
The following is the syntax for constant expressions:

``trunc (CST to TYPE)``
Perform the :ref:`trunc operation ` on constants.
``zext (CST to TYPE)``
Perform the :ref:`zext operation ` on constants.
``sext (CST to TYPE)``
Perform the :ref:`sext operation ` on constants.
``fptrunc (CST to TYPE)``
Truncate a floating-point constant to another floating-point type.
The size of CST must be larger than the size of TYPE. Both types
must be floating-point.
``fpext (CST to TYPE)``
Floating-point extend a constant to another type. The size of CST
must be smaller or equal to the size of TYPE. Both types must be
floating-point.
``fptoui (CST to TYPE)``
Convert a floating-point constant to the corresponding unsigned
integer constant. TYPE must be a scalar or vector integer type. CST
must be of scalar or vector floating-point type. Both CST and TYPE
must be scalars, or vectors of the same number of elements. If the
value won't fit in the integer type, the result is a
:ref:`poison value `.
``fptosi (CST to TYPE)``
Convert a floating-point constant to the corresponding signed
integer constant. TYPE must be a scalar or vector integer type. CST
must be of scalar or vector floating-point type. Both CST and TYPE
must be scalars, or vectors of the same number of elements. If the
value won't fit in the integer type, the result is a
:ref:`poison value `.
``uitofp (CST to TYPE)``
Convert an unsigned integer constant to the corresponding
floating-point constant. TYPE must be a scalar or vector floating-point
type. CST must be of scalar or vector integer type. Both CST and TYPE must
be scalars, or vectors of the same number of elements.
``sitofp (CST to TYPE)``
Convert a signed integer constant to the corresponding floating-point
constant. TYPE must be a scalar or vector floating-point type.
CST must be of scalar or vector integer type. Both CST and TYPE must
be scalars, or vectors of the same number of elements.
``ptrtoint (CST to TYPE)``
Perform the :ref:`ptrtoint operation ` on constants.
``inttoptr (CST to TYPE)``
Perform the :ref:`inttoptr operation ` on constants.
This one is *really* dangerous!
``bitcast (CST to TYPE)``
Convert a constant, CST, to another TYPE.
The constraints of the operands are the same as those for the
:ref:`bitcast instruction `.
``addrspacecast (CST to TYPE)``
Convert a constant pointer or constant vector of pointer, CST, to another
TYPE in a different address space. The constraints of the operands are the
same as those for the :ref:`addrspacecast instruction `.
``getelementptr (TY, CSTPTR, IDX0, IDX1, ...)``, ``getelementptr inbounds (TY, CSTPTR, IDX0, IDX1, ...)``
Perform the :ref:`getelementptr operation ` on
constants. As with the :ref:`getelementptr `
instruction, the index list may have one or more indexes, which are
required to make sense for the type of "pointer to TY".
``select (COND, VAL1, VAL2)``
Perform the :ref:`select operation ` on constants.
``icmp COND (VAL1, VAL2)``
Perform the :ref:`icmp operation ` on constants.
``fcmp COND (VAL1, VAL2)``
Perform the :ref:`fcmp operation ` on constants.
``extractelement (VAL, IDX)``
Perform the :ref:`extractelement operation ` on
constants.
``insertelement (VAL, ELT, IDX)``
Perform the :ref:`insertelement operation ` on
constants.
``shufflevector (VEC1, VEC2, IDXMASK)``
Perform the :ref:`shufflevector operation ` on
constants.
``extractvalue (VAL, IDX0, IDX1, ...)``
Perform the :ref:`extractvalue operation ` on
constants. The index list is interpreted in a similar manner as
indices in a ':ref:`getelementptr `' operation. At
least one index value must be specified.
``insertvalue (VAL, ELT, IDX0, IDX1, ...)``
Perform the :ref:`insertvalue operation ` on constants.
The index list is interpreted in a similar manner as indices in a
':ref:`getelementptr `' operation. At least one index
value must be specified.
``OPCODE (LHS, RHS)``
Perform the specified operation of the LHS and RHS constants. OPCODE
may be any of the :ref:`binary ` or :ref:`bitwise
binary ` operations. The constraints on operands are
the same as those for the corresponding instruction (e.g. no bitwise
operations on floating-point values are allowed).

Other Values
============

.. _inlineasmexprs:

Inline Assembler Expressions
----------------------------

LLVM supports inline assembler expressions (as opposed to :ref:`Module-Level
Inline Assembly `) through the use of a special value. This value
represents the inline assembler as a template string (containing the
instructions to emit), a list of operand constraints (stored as a string), a
flag that indicates whether or not the inline asm expression has side effects,
and a flag indicating whether the function containing the asm needs to align its
stack conservatively.

The template string supports argument substitution of the operands using "``$``"
followed by a number, to indicate substitution of the given register/memory
location, as specified by the constraint string. "``${NUM:MODIFIER}``" may also
be used, where ``MODIFIER`` is a target-specific annotation for how to print the
operand (See :ref:`inline-asm-modifiers`).

A literal "``$``" may be included by using "``$$``" in the template. To include
other special characters into the output, the usual "``\XX``" escapes may be
used, just as in other strings. Note that after template substitution, the
resulting assembly string is parsed by LLVM's integrated assembler unless it is
disabled -- even when emitting a ``.s`` file -- and thus must contain assembly
syntax known to LLVM.

LLVM also supports a few more substitutions useful for writing inline assembly:

- ``${:uid}``: Expands to a decimal integer unique to this inline assembly blob.
This substitution is useful when declaring a local label. Many standard
compiler optimizations, such as inlining, may duplicate an inline asm blob.
Adding a blob-unique identifier ensures that the two labels will not conflict
during assembly. This is used to implement `GCC's %= special format
string `_.
- ``${:comment}``: Expands to the comment character of the current target's
assembly dialect. This is usually ``#``, but many targets use other strings,
such as ``;``, ``//``, or ``!``.
- ``${:private}``: Expands to the assembler private label prefix. Labels with
this prefix will not appear in the symbol table of the assembled object.
Typically the prefix is ``L``, but targets may use other strings. ``.L`` is
relatively popular.

LLVM's support for inline asm is modeled closely on the requirements of Clang's
GCC-compatible inline-asm support. Thus, the feature-set and the constraint and
modifier codes listed here are similar or identical to those in GCC's inline asm
support. However, to be clear, the syntax of the template and constraint strings
described here is *not* the same as the syntax accepted by GCC and Clang, and,
while most constraint letters are passed through as-is by Clang, some get
translated to other codes when converting from the C source to the LLVM
assembly.

An example inline assembler expression is:

.. code-block:: llvm

i32 (i32) asm "bswap $0", "=r,r"

Inline assembler expressions may **only** be used as the callee operand
of a :ref:`call ` or an :ref:`invoke ` instruction.
Thus, typically we have:

.. code-block:: llvm

%X = call i32 asm "bswap $0", "=r,r"(i32 %Y)

Inline asms with side effects not visible in the constraint list must be
marked as having side effects. This is done through the use of the
'``sideeffect``' keyword, like so:

.. code-block:: llvm

call void asm sideeffect "eieio", ""()

In some cases inline asms will contain code that will not work unless
the stack is aligned in some way, such as calls or SSE instructions on
x86, yet will not contain code that does that alignment within the asm.
The compiler should make conservative assumptions about what the asm
might contain and should generate its usual stack alignment code in the
prologue if the '``alignstack``' keyword is present:

.. code-block:: llvm

call void asm alignstack "eieio", ""()

Inline asms also support using non-standard assembly dialects. The
assumed dialect is ATT. When the '``inteldialect``' keyword is present,
the inline asm is using the Intel dialect. Currently, ATT and Intel are
the only supported dialects. An example is:

.. code-block:: llvm

call void asm inteldialect "eieio", ""()

If multiple keywords appear the '``sideeffect``' keyword must come
first, the '``alignstack``' keyword second and the '``inteldialect``'
keyword last.

Inline Asm Constraint String
^^^^^^^^^^^^^^^^^^^^^^^^^^^^

The constraint list is a comma-separated string, each element containing one or
more constraint codes.

For each element in the constraint list an appropriate register or memory
operand will be chosen, and it will be made available to assembly template
string expansion as ``$0`` for the first constraint in the list, ``$1`` for the
second, etc.

There are three different types of constraints, which are distinguished by a
prefix symbol in front of the constraint code: Output, Input, and Clobber. The
constraints must always be given in that order: outputs first, then inputs, then
clobbers. They cannot be intermingled.

There are also three different categories of constraint codes:

- Register constraint. This is either a register class, or a fixed physical
register. This kind of constraint will allocate a register, and if necessary,
bitcast the argument or result to the appropriate type.
- Memory constraint. This kind of constraint is for use with an instruction
taking a memory operand. Different constraints allow for different addressing
modes used by the target.
- Immediate value constraint. This kind of constraint is for an integer or other
immediate value which can be rendered directly into an instruction. The
various target-specific constraints allow the selection of a value in the
proper range for the instruction you wish to use it with.

Output constraints
""""""""""""""""""

Output constraints are specified by an "``=``" prefix (e.g. "``=r``"). This
indicates that the assembly will write to this operand, and the operand will
then be made available as a return value of the ``asm`` expression. Output
constraints do not consume an argument from the call instruction. (Except, see
below about indirect outputs).

Normally, it is expected that no output locations are written to by the assembly
expression until *all* of the inputs have been read. As such, LLVM may assign
the same register to an output and an input. If this is not safe (e.g. if the
assembly contains two instructions, where the first writes to one output, and
the second reads an input and writes to a second output), then the "``&``"
modifier must be used (e.g. "``=&r``") to specify that the output is an
"early-clobber" output. Marking an output as "early-clobber" ensures that LLVM
will not use the same register for any inputs (other than an input tied to this
output).

Input constraints
"""""""""""""""""

Input constraints do not have a prefix -- just the constraint codes. Each input
constraint will consume one argument from the call instruction. It is not
permitted for the asm to write to any input register or memory location (unless
that input is tied to an output). Note also that multiple inputs may all be
assigned to the same register, if LLVM can determine that they necessarily all
contain the same value.

Instead of providing a Constraint Code, input constraints may also "tie"
themselves to an output constraint, by providing an integer as the constraint
string. Tied inputs still consume an argument from the call instruction, and
take up a position in the asm template numbering as is usual -- they will simply
be constrained to always use the same register as the output they've been tied
to. For example, a constraint string of "``=r,0``" says to assign a register for
output, and use that register as an input as well (it being the 0'th
constraint).

It is permitted to tie an input to an "early-clobber" output. In that case, no
*other* input may share the same register as the input tied to the early-clobber
(even when the other input has the same value).

You may only tie an input to an output which has a register constraint, not a
memory constraint. Only a single input may be tied to an output.

There is also an "interesting" feature which deserves a bit of explanation: if a
register class constraint allocates a register which is too small for the value
type operand provided as input, the input value will be split into multiple
registers, and all of them passed to the inline asm.

However, this feature is often not as useful as you might think.

Firstly, the registers are *not* guaranteed to be consecutive. So, on those
architectures that have instructions which operate on multiple consecutive
instructions, this is not an appropriate way to support them. (e.g. the 32-bit
SparcV8 has a 64-bit load, which instruction takes a single 32-bit register. The
hardware then loads into both the named register, and the next register. This
feature of inline asm would not be useful to support that.)

A few of the targets provide a template string modifier allowing explicit access
to the second register of a two-register operand (e.g. MIPS ``L``, ``M``, and
``D``). On such an architecture, you can actually access the second allocated
register (yet, still, not any subsequent ones). But, in that case, you're still
probably better off simply splitting the value into two separate operands, for
clarity. (e.g. see the description of the ``A`` constraint on X86, which,
despite existing only for use with this feature, is not really a good idea to
use)

Indirect inputs and outputs
"""""""""""""""""""""""""""

Indirect output or input constraints can be specified by the "``*``" modifier
(which goes after the "``=``" in case of an output). This indicates that the asm
will write to or read from the contents of an *address* provided as an input
argument. (Note that in this way, indirect outputs act more like an *input* than
an output: just like an input, they consume an argument of the call expression,
rather than producing a return value. An indirect output constraint is an
"output" only in that the asm is expected to write to the contents of the input
memory location, instead of just read from it).

This is most typically used for memory constraint, e.g. "``=*m``", to pass the
address of a variable as a value.

It is also possible to use an indirect *register* constraint, but only on output
(e.g. "``=*r``"). This will cause LLVM to allocate a register for an output
value normally, and then, separately emit a store to the address provided as
input, after the provided inline asm. (It's not clear what value this
functionality provides, compared to writing the store explicitly after the asm
statement, and it can only produce worse code, since it bypasses many
optimization passes. I would recommend not using it.)

Clobber constraints
"""""""""""""""""""

A clobber constraint is indicated by a "``~``" prefix. A clobber does not
consume an input operand, nor generate an output. Clobbers cannot use any of the
general constraint code letters -- they may use only explicit register
constraints, e.g. "``~{eax}``". The one exception is that a clobber string of
"``~{memory}``" indicates that the assembly writes to arbitrary undeclared
memory locations -- not only the memory pointed to by a declared indirect
output.

Note that clobbering named registers that are also present in output
constraints is not legal.

Constraint Codes
""""""""""""""""
After a potential prefix comes constraint code, or codes.

A Constraint Code is either a single letter (e.g. "``r``"), a "``^``" character
followed by two letters (e.g. "``^wc``"), or "``{``" register-name "``}``"
(e.g. "``{eax}``").

The one and two letter constraint codes are typically chosen to be the same as
GCC's constraint codes.

A single constraint may include one or more than constraint code in it, leaving
it up to LLVM to choose which one to use. This is included mainly for
compatibility with the translation of GCC inline asm coming from clang.

There are two ways to specify alternatives, and either or both may be used in an
inline asm constraint list:

1) Append the codes to each other, making a constraint code set. E.g. "``im``"
or "``{eax}m``". This means "choose any of the options in the set". The
choice of constraint is made independently for each constraint in the
constraint list.

2) Use "``|``" between constraint code sets, creating alternatives. Every
constraint in the constraint list must have the same number of alternative
sets. With this syntax, the same alternative in *all* of the items in the
constraint list will be chosen together.

Putting those together, you might have a two operand constraint string like
``"rm|r,ri|rm"``. This indicates that if operand 0 is ``r`` or ``m``, then
operand 1 may be one of ``r`` or ``i``. If operand 0 is ``r``, then operand 1
may be one of ``r`` or ``m``. But, operand 0 and 1 cannot both be of type m.

However, the use of either of the alternatives features is *NOT* recommended, as
LLVM is not able to make an intelligent choice about which one to use. (At the
point it currently needs to choose, not enough information is available to do so
in a smart way.) Thus, it simply tries to make a choice that's most likely to
compile, not one that will be optimal performance. (e.g., given "``rm``", it'll
always choose to use memory, not registers). And, if given multiple registers,
or multiple register classes, it will simply choose the first one. (In fact, it
doesn't currently even ensure explicitly specified physical registers are
unique, so specifying multiple physical registers as alternatives, like
``{r11}{r12},{r11}{r12}``, will assign r11 to both operands, not at all what was
intended.)

Supported Constraint Code List
""""""""""""""""""""""""""""""

The constraint codes are, in general, expected to behave the same way they do in
GCC. LLVM's support is often implemented on an 'as-needed' basis, to support C
inline asm code which was supported by GCC. A mismatch in behavior between LLVM
and GCC likely indicates a bug in LLVM.

Some constraint codes are typically supported by all targets:

- ``r``: A register in the target's general purpose register class.
- ``m``: A memory address operand. It is target-specific what addressing modes
are supported, typical examples are register, or register + register offset,
or register + immediate offset (of some target-specific size).
- ``i``: An integer constant (of target-specific width). Allows either a simple
immediate, or a relocatable value.
- ``n``: An integer constant -- *not* including relocatable values.
- ``s``: An integer constant, but allowing *only* relocatable values.
- ``X``: Allows an operand of any kind, no constraint whatsoever. Typically
useful to pass a label for an asm branch or call.

.. FIXME: but that surely isn't actually okay to jump out of an asm
block without telling llvm about the control transfer???)

- ``{register-name}``: Requires exactly the named physical register.

Other constraints are target-specific:

AArch64:

- ``z``: An immediate integer 0. Outputs ``WZR`` or ``XZR``, as appropriate.
- ``I``: An immediate integer valid for an ``ADD`` or ``SUB`` instruction,
i.e. 0 to 4095 with optional shift by 12.
- ``J``: An immediate integer that, when negated, is valid for an ``ADD`` or
``SUB`` instruction, i.e. -1 to -4095 with optional left shift by 12.
- ``K``: An immediate integer that is valid for the 'bitmask immediate 32' of a
logical instruction like ``AND``, ``EOR``, or ``ORR`` with a 32-bit register.
- ``L``: An immediate integer that is valid for the 'bitmask immediate 64' of a
logical instruction like ``AND``, ``EOR``, or ``ORR`` with a 64-bit register.
- ``M``: An immediate integer for use with the ``MOV`` assembly alias on a
32-bit register. This is a superset of ``K``: in addition to the bitmask
immediate, also allows immediate integers which can be loaded with a single
``MOVZ`` or ``MOVL`` instruction.
- ``N``: An immediate integer for use with the ``MOV`` assembly alias on a
64-bit register. This is a superset of ``L``.
- ``Q``: Memory address operand must be in a single register (no
offsets). (However, LLVM currently does this for the ``m`` constraint as
well.)
- ``r``: A 32 or 64-bit integer register (W* or X*).
- ``w``: A 32, 64, or 128-bit floating-point, SIMD or SVE vector register.
- ``x``: Like w, but restricted to registers 0 to 15 inclusive.
- ``y``: Like w, but restricted to SVE vector registers Z0 to Z7 inclusive.
- ``Upl``: One of the low eight SVE predicate registers (P0 to P7)
- ``Upa``: Any of the SVE predicate registers (P0 to P15)

AMDGPU:

- ``r``: A 32 or 64-bit integer register.
- ``[0-9]v``: The 32-bit VGPR register, number 0-9.
- ``[0-9]s``: The 32-bit SGPR register, number 0-9.
- ``[0-9]a``: The 32-bit AGPR register, number 0-9.
- ``I``: An integer inline constant in the range from -16 to 64.
- ``J``: A 16-bit signed integer constant.
- ``A``: An integer or a floating-point inline constant.
- ``B``: A 32-bit signed integer constant.
- ``C``: A 32-bit unsigned integer constant or an integer inline constant in the range from -16 to 64.
- ``DA``: A 64-bit constant that can be split into two "A" constants.
- ``DB``: A 64-bit constant that can be split into two "B" constants.

All ARM modes:

- ``Q``, ``Um``, ``Un``, ``Uq``, ``Us``, ``Ut``, ``Uv``, ``Uy``: Memory address
operand. Treated the same as operand ``m``, at the moment.
- ``Te``: An even general-purpose 32-bit integer register: ``r0,r2,...,r12,r14``
- ``To``: An odd general-purpose 32-bit integer register: ``r1,r3,...,r11``

ARM and ARM's Thumb2 mode:

- ``j``: An immediate integer between 0 and 65535 (valid for ``MOVW``)
- ``I``: An immediate integer valid for a data-processing instruction.
- ``J``: An immediate integer between -4095 and 4095.
- ``K``: An immediate integer whose bitwise inverse is valid for a
data-processing instruction. (Can be used with template modifier "``B``" to
print the inverted value).
- ``L``: An immediate integer whose negation is valid for a data-processing
instruction. (Can be used with template modifier "``n``" to print the negated
value).
- ``M``: A power of two or a integer between 0 and 32.
- ``N``: Invalid immediate constraint.
- ``O``: Invalid immediate constraint.
- ``r``: A general-purpose 32-bit integer register (``r0-r15``).
- ``l``: In Thumb2 mode, low 32-bit GPR registers (``r0-r7``). In ARM mode, same
as ``r``.
- ``h``: In Thumb2 mode, a high 32-bit GPR register (``r8-r15``). In ARM mode,
invalid.
- ``w``: A 32, 64, or 128-bit floating-point/SIMD register in the ranges
``s0-s31``, ``d0-d31``, or ``q0-q15``, respectively.
- ``t``: A 32, 64, or 128-bit floating-point/SIMD register in the ranges
``s0-s31``, ``d0-d15``, or ``q0-q7``, respectively.
- ``x``: A 32, 64, or 128-bit floating-point/SIMD register in the ranges
``s0-s15``, ``d0-d7``, or ``q0-q3``, respectively.

ARM's Thumb1 mode:

- ``I``: An immediate integer between 0 and 255.
- ``J``: An immediate integer between -255 and -1.
- ``K``: An immediate integer between 0 and 255, with optional left-shift by
some amount.
- ``L``: An immediate integer between -7 and 7.
- ``M``: An immediate integer which is a multiple of 4 between 0 and 1020.
- ``N``: An immediate integer between 0 and 31.
- ``O``: An immediate integer which is a multiple of 4 between -508 and 508.
- ``r``: A low 32-bit GPR register (``r0-r7``).
- ``l``: A low 32-bit GPR register (``r0-r7``).
- ``h``: A high GPR register (``r0-r7``).
- ``w``: A 32, 64, or 128-bit floating-point/SIMD register in the ranges
``s0-s31``, ``d0-d31``, or ``q0-q15``, respectively.
- ``t``: A 32, 64, or 128-bit floating-point/SIMD register in the ranges
``s0-s31``, ``d0-d15``, or ``q0-q7``, respectively.
- ``x``: A 32, 64, or 128-bit floating-point/SIMD register in the ranges
``s0-s15``, ``d0-d7``, or ``q0-q3``, respectively.

Hexagon:

- ``o``, ``v``: A memory address operand, treated the same as constraint ``m``,
at the moment.
- ``r``: A 32 or 64-bit register.

MSP430:

- ``r``: An 8 or 16-bit register.

MIPS:

- ``I``: An immediate signed 16-bit integer.
- ``J``: An immediate integer zero.
- ``K``: An immediate unsigned 16-bit integer.
- ``L``: An immediate 32-bit integer, where the lower 16 bits are 0.
- ``N``: An immediate integer between -65535 and -1.
- ``O``: An immediate signed 15-bit integer.
- ``P``: An immediate integer between 1 and 65535.
- ``m``: A memory address operand. In MIPS-SE mode, allows a base address
register plus 16-bit immediate offset. In MIPS mode, just a base register.
- ``R``: A memory address operand. In MIPS-SE mode, allows a base address
register plus a 9-bit signed offset. In MIPS mode, the same as constraint
``m``.
- ``ZC``: A memory address operand, suitable for use in a ``pref``, ``ll``, or
``sc`` instruction on the given subtarget (details vary).
- ``r``, ``d``, ``y``: A 32 or 64-bit GPR register.
- ``f``: A 32 or 64-bit FPU register (``F0-F31``), or a 128-bit MSA register
(``W0-W31``). In the case of MSA registers, it is recommended to use the ``w``
argument modifier for compatibility with GCC.
- ``c``: A 32-bit or 64-bit GPR register suitable for indirect jump (always
``25``).
- ``l``: The ``lo`` register, 32 or 64-bit.
- ``x``: Invalid.

NVPTX:

- ``b``: A 1-bit integer register.
- ``c`` or ``h``: A 16-bit integer register.
- ``r``: A 32-bit integer register.
- ``l`` or ``N``: A 64-bit integer register.
- ``f``: A 32-bit float register.
- ``d``: A 64-bit float register.

PowerPC:

- ``I``: An immediate signed 16-bit integer.
- ``J``: An immediate unsigned 16-bit integer, shifted left 16 bits.
- ``K``: An immediate unsigned 16-bit integer.
- ``L``: An immediate signed 16-bit integer, shifted left 16 bits.
- ``M``: An immediate integer greater than 31.
- ``N``: An immediate integer that is an exact power of 2.
- ``O``: The immediate integer constant 0.
- ``P``: An immediate integer constant whose negation is a signed 16-bit
constant.
- ``es``, ``o``, ``Q``, ``Z``, ``Zy``: A memory address operand, currently
treated the same as ``m``.
- ``r``: A 32 or 64-bit integer register.
- ``b``: A 32 or 64-bit integer register, excluding ``R0`` (that is:
``R1-R31``).
- ``f``: A 32 or 64-bit float register (``F0-F31``), or when QPX is enabled, a
128 or 256-bit QPX register (``Q0-Q31``; aliases the ``F`` registers).
- ``v``: For ``4 x f32`` or ``4 x f64`` types, when QPX is enabled, a
128 or 256-bit QPX register (``Q0-Q31``), otherwise a 128-bit
altivec vector register (``V0-V31``).

.. FIXME: is this a bug that v accepts QPX registers? I think this
is supposed to only use the altivec vector registers?

- ``y``: Condition register (``CR0-CR7``).
- ``wc``: An individual CR bit in a CR register.
- ``wa``, ``wd``, ``wf``: Any 128-bit VSX vector register, from the full VSX
register set (overlapping both the floating-point and vector register files).
- ``ws``: A 32 or 64-bit floating-point register, from the full VSX register
set.

RISC-V:

- ``A``: An address operand (using a general-purpose register, without an
offset).
- ``I``: A 12-bit signed integer immediate operand.
- ``J``: A zero integer immediate operand.
- ``K``: A 5-bit unsigned integer immediate operand.
- ``f``: A 32- or 64-bit floating-point register (requires F or D extension).
- ``r``: A 32- or 64-bit general-purpose register (depending on the platform
``XLEN``).

Sparc:

- ``I``: An immediate 13-bit signed integer.
- ``r``: A 32-bit integer register.
- ``f``: Any floating-point register on SparcV8, or a floating-point
register in the "low" half of the registers on SparcV9.
- ``e``: Any floating-point register. (Same as ``f`` on SparcV8.)

SystemZ:

- ``I``: An immediate unsigned 8-bit integer.
- ``J``: An immediate unsigned 12-bit integer.
- ``K``: An immediate signed 16-bit integer.
- ``L``: An immediate signed 20-bit integer.
- ``M``: An immediate integer 0x7fffffff.
- ``Q``: A memory address operand with a base address and a 12-bit immediate
unsigned displacement.
- ``R``: A memory address operand with a base address, a 12-bit immediate
unsigned displacement, and an index register.
- ``S``: A memory address operand with a base address and a 20-bit immediate
signed displacement.
- ``T``: A memory address operand with a base address, a 20-bit immediate
signed displacement, and an index register.
- ``r`` or ``d``: A 32, 64, or 128-bit integer register.
- ``a``: A 32, 64, or 128-bit integer address register (excludes R0, which in an
address context evaluates as zero).
- ``h``: A 32-bit value in the high part of a 64bit data register
(LLVM-specific)
- ``f``: A 32, 64, or 128-bit floating-point register.

X86:

- ``I``: An immediate integer between 0 and 31.
- ``J``: An immediate integer between 0 and 64.
- ``K``: An immediate signed 8-bit integer.
- ``L``: An immediate integer, 0xff or 0xffff or (in 64-bit mode only)
0xffffffff.
- ``M``: An immediate integer between 0 and 3.
- ``N``: An immediate unsigned 8-bit integer.
- ``O``: An immediate integer between 0 and 127.
- ``e``: An immediate 32-bit signed integer.
- ``Z``: An immediate 32-bit unsigned integer.
- ``o``, ``v``: Treated the same as ``m``, at the moment.
- ``q``: An 8, 16, 32, or 64-bit register which can be accessed as an 8-bit
``l`` integer register. On X86-32, this is the ``a``, ``b``, ``c``, and ``d``
registers, and on X86-64, it is all of the integer registers.
- ``Q``: An 8, 16, 32, or 64-bit register which can be accessed as an 8-bit
``h`` integer register. This is the ``a``, ``b``, ``c``, and ``d`` registers.
- ``r`` or ``l``: An 8, 16, 32, or 64-bit integer register.
- ``R``: An 8, 16, 32, or 64-bit "legacy" integer register -- one which has
existed since i386, and can be accessed without the REX prefix.
- ``f``: A 32, 64, or 80-bit '387 FPU stack pseudo-register.
- ``y``: A 64-bit MMX register, if MMX is enabled.
- ``x``: If SSE is enabled: a 32 or 64-bit scalar operand, or 128-bit vector
operand in a SSE register. If AVX is also enabled, can also be a 256-bit
vector operand in an AVX register. If AVX-512 is also enabled, can also be a
512-bit vector operand in an AVX512 register, Otherwise, an error.
- ``Y``: The same as ``x``, if *SSE2* is enabled, otherwise an error.
- ``A``: Special case: allocates EAX first, then EDX, for a single operand (in
32-bit mode, a 64-bit integer operand will get split into two registers). It
is not recommended to use this constraint, as in 64-bit mode, the 64-bit
operand will get allocated only to RAX -- if two 32-bit operands are needed,
you're better off splitting it yourself, before passing it to the asm
statement.

XCore:

- ``r``: A 32-bit integer register.

.. _inline-asm-modifiers:

Asm template argument modifiers
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

In the asm template string, modifiers can be used on the operand reference, like
"``${0:n}``".

The modifiers are, in general, expected to behave the same way they do in
GCC. LLVM's support is often implemented on an 'as-needed' basis, to support C
inline asm code which was supported by GCC. A mismatch in behavior between LLVM
and GCC likely indicates a bug in LLVM.

Target-independent:

- ``c``: Print an immediate integer constant unadorned, without
the target-specific immediate punctuation (e.g. no ``$`` prefix).
- ``n``: Negate and print immediate integer constant unadorned, without the
target-specific immediate punctuation (e.g. no ``$`` prefix).
- ``l``: Print as an unadorned label, without the target-specific label
punctuation (e.g. no ``$`` prefix).

AArch64:

- ``w``: Print a GPR register with a ``w*`` name instead of ``x*`` name. E.g.,
instead of ``x30``, print ``w30``.
- ``x``: Print a GPR register with a ``x*`` name. (this is the default, anyhow).
- ``b``, ``h``, ``s``, ``d``, ``q``: Print a floating-point/SIMD register with a
``b*``, ``h*``, ``s*``, ``d*``, or ``q*`` name, rather than the default of
``v*``.

AMDGPU:

- ``r``: No effect.

ARM:

- ``a``: Print an operand as an address (with ``[`` and ``]`` surrounding a
register).
- ``P``: No effect.
- ``q``: No effect.
- ``y``: Print a VFP single-precision register as an indexed double (e.g. print
as ``d4[1]`` instead of ``s9``)
- ``B``: Bitwise invert and print an immediate integer constant without ``#``
prefix.
- ``L``: Print the low 16-bits of an immediate integer constant.
- ``M``: Print as a register set suitable for ldm/stm. Also prints *all*
register operands subsequent to the specified one (!), so use carefully.
- ``Q``: Print the low-order register of a register-pair, or the low-order
register of a two-register operand.
- ``R``: Print the high-order register of a register-pair, or the high-order
register of a two-register operand.
- ``H``: Print the second register of a register-pair. (On a big-endian system,
``H`` is equivalent to ``Q``, and on little-endian system, ``H`` is equivalent
to ``R``.)

.. FIXME: H doesn't currently support printing the second register
of a two-register operand.

- ``e``: Print the low doubleword register of a NEON quad register.
- ``f``: Print the high doubleword register of a NEON quad register.
- ``m``: Print the base register of a memory operand without the ``[`` and ``]``
adornment.

Hexagon:

- ``L``: Print the second register of a two-register operand. Requires that it
has been allocated consecutively to the first.

.. FIXME: why is it restricted to consecutive ones? And there's
nothing that ensures that happens, is there?

- ``I``: Print the letter 'i' if the operand is an integer constant, otherwise
nothing. Used to print 'addi' vs 'add' instructions.

MSP430:

No additional modifiers.

MIPS:

- ``X``: Print an immediate integer as hexadecimal
- ``x``: Print the low 16 bits of an immediate integer as hexadecimal.
- ``d``: Print an immediate integer as decimal.
- ``m``: Subtract one and print an immediate integer as decimal.
- ``z``: Print $0 if an immediate zero, otherwise print normally.
- ``L``: Print the low-order register of a two-register operand, or prints the
address of the low-order word of a double-word memory operand.

.. FIXME: L seems to be missing memory operand support.

- ``M``: Print the high-order register of a two-register operand, or prints the
address of the high-order word of a double-word memory operand.

.. FIXME: M seems to be missing memory operand support.

- ``D``: Print the second register of a two-register operand, or prints the
second word of a double-word memory operand. (On a big-endian system, ``D`` is
equivalent to ``L``, and on little-endian system, ``D`` is equivalent to
``M``.)
- ``w``: No effect. Provided for compatibility with GCC which requires this
modifier in order to print MSA registers (``W0-W31``) with the ``f``
constraint.

NVPTX:

- ``r``: No effect.

PowerPC:

- ``L``: Print the second register of a two-register operand. Requires that it
has been allocated consecutively to the first.

.. FIXME: why is it restricted to consecutive ones? And there's
nothing that ensures that happens, is there?

- ``I``: Print the letter 'i' if the operand is an integer constant, otherwise
nothing. Used to print 'addi' vs 'add' instructions.
- ``y``: For a memory operand, prints formatter for a two-register X-form
instruction. (Currently always prints ``r0,OPERAND``).
- ``U``: Prints 'u' if the memory operand is an update form, and nothing
otherwise. (NOTE: LLVM does not support update form, so this will currently
always print nothing)
- ``X``: Prints 'x' if the memory operand is an indexed form. (NOTE: LLVM does
not support indexed form, so this will currently always print nothing)

RISC-V:

- ``i``: Print the letter 'i' if the operand is not a register, otherwise print
nothing. Used to print 'addi' vs 'add' instructions, etc.
- ``z``: Print the register ``zero`` if an immediate zero, otherwise print
normally.

Sparc:

- ``r``: No effect.

SystemZ:

SystemZ implements only ``n``, and does *not* support any of the other
target-independent modifiers.

X86:

- ``c``: Print an unadorned integer or symbol name. (The latter is
target-specific behavior for this typically target-independent modifier).
- ``A``: Print a register name with a '``*``' before it.
- ``b``: Print an 8-bit register name (e.g. ``al``); do nothing on a memory
operand.
- ``h``: Print the upper 8-bit register name (e.g. ``ah``); do nothing on a
memory operand.
- ``w``: Print the 16-bit register name (e.g. ``ax``); do nothing on a memory
operand.
- ``k``: Print the 32-bit register name (e.g. ``eax``); do nothing on a memory
operand.
- ``q``: Print the 64-bit register name (e.g. ``rax``), if 64-bit registers are
available, otherwise the 32-bit register name; do nothing on a memory operand.
- ``n``: Negate and print an unadorned integer, or, for operands other than an
immediate integer (e.g. a relocatable symbol expression), print a '-' before
the operand. (The behavior for relocatable symbol expressions is a
target-specific behavior for this typically target-independent modifier)
- ``H``: Print a memory reference with additional offset +8.
- ``P``: Print a memory reference or operand for use as the argument of a call
instruction. (E.g. omit ``(rip)``, even though it's PC-relative.)

XCore:

No additional modifiers.

Inline Asm Metadata
^^^^^^^^^^^^^^^^^^^

The call instructions that wrap inline asm nodes may have a
"``!srcloc``" MDNode attached to it that contains a list of constant
integers. If present, the code generator will use the integer as the
location cookie value when report errors through the ``LLVMContext``
error reporting mechanisms. This allows a front-end to correlate backend
errors that occur with inline asm back to the source code that produced
it. For example:

.. code-block:: llvm

call void asm sideeffect "something bad", ""(), !srcloc !42
...
!42 = !{ i32 1234567 }

It is up to the front-end to make sense of the magic numbers it places
in the IR. If the MDNode contains multiple constants, the code generator
will use the one that corresponds to the line of the asm that the error
occurs on.

.. _metadata:

Metadata
========

LLVM IR allows metadata to be attached to instructions in the program
that can convey extra information about the code to the optimizers and
code generator. One example application of metadata is source-level
debug information. There are two metadata primitives: strings and nodes.

Metadata does not have a type, and is not a value. If referenced from a
``call`` instruction, it uses the ``metadata`` type.

All metadata are identified in syntax by a exclamation point ('``!``').

.. _metadata-string:

Metadata Nodes and Metadata Strings
-----------------------------------

A metadata string is a string surrounded by double quotes. It can
contain any character by escaping non-printable characters with
"``\xx``" where "``xx``" is the two digit hex code. For example:
"``!"test\00"``".

Metadata nodes are represented with notation similar to structure
constants (a comma separated list of elements, surrounded by braces and
preceded by an exclamation point). Metadata nodes can have any values as
their operand. For example:

.. code-block:: llvm

!{ !"test\00", i32 10}

Metadata nodes that aren't uniqued use the ``distinct`` keyword. For example:

.. code-block:: text

!0 = distinct !{!"test\00", i32 10}

``distinct`` nodes are useful when nodes shouldn't be merged based on their
content. They can also occur when transformations cause uniquing collisions
when metadata operands change.

A :ref:`named metadata ` is a collection of
metadata nodes, which can be looked up in the module symbol table. For
example:

.. code-block:: llvm

!foo = !{!4, !3}

Metadata can be used as function arguments. Here the ``llvm.dbg.value``
intrinsic is using three metadata arguments:

.. code-block:: llvm

call void @llvm.dbg.value(metadata !24, metadata !25, metadata !26)

Metadata can be attached to an instruction. Here metadata ``!21`` is attached
to the ``add`` instruction using the ``!dbg`` identifier:

.. code-block:: llvm

%indvar.next = add i64 %indvar, 1, !dbg !21

Metadata can also be attached to a function or a global variable. Here metadata
``!22`` is attached to the ``f1`` and ``f2`` functions, and the globals ``g1``
and ``g2`` using the ``!dbg`` identifier:

.. code-block:: llvm

declare !dbg !22 void @f1()
define void @f2() !dbg !22 {
ret void
}

@g1 = global i32 0, !dbg !22
@g2 = external global i32, !dbg !22

A transformation is required to drop any metadata attachment that it does not
know or know it can't preserve. Currently there is an exception for metadata
attachment to globals for ``!type`` and ``!absolute_symbol`` which can't be
unconditionally dropped unless the global is itself deleted.

Metadata attached to a module using named metadata may not be dropped, with
the exception of debug metadata (named metadata with the name ``!llvm.dbg.*``).

More information about specific metadata nodes recognized by the
optimizers and code generator is found below.

.. _specialized-metadata:

Specialized Metadata Nodes
^^^^^^^^^^^^^^^^^^^^^^^^^^

Specialized metadata nodes are custom data structures in metadata (as opposed
to generic tuples). Their fields are labelled, and can be specified in any
order.

These aren't inherently debug info centric, but currently all the specialized
metadata nodes are related to debug info.

.. _DICompileUnit:

DICompileUnit
"""""""""""""

``DICompileUnit`` nodes represent a compile unit. The ``enums:``,
``retainedTypes:``, ``globals:``, ``imports:`` and ``macros:`` fields are tuples
containing the debug info to be emitted along with the compile unit, regardless
of code optimizations (some nodes are only emitted if there are references to
them from instructions). The ``debugInfoForProfiling:`` field is a boolean
indicating whether or not line-table discriminators are updated to provide
more-accurate debug info for profiling results.

.. code-block:: text

!0 = !DICompileUnit(language: DW_LANG_C99, file: !1, producer: "clang",
isOptimized: true, flags: "-O2", runtimeVersion: 2,
splitDebugFilename: "abc.debug", emissionKind: FullDebug,
enums: !2, retainedTypes: !3, globals: !4, imports: !5,
macros: !6, dwoId: 0x0abcd)

Compile unit descriptors provide the root scope for objects declared in a
specific compilation unit. File descriptors are defined using this scope. These
descriptors are collected by a named metadata node ``!llvm.dbg.cu``. They keep
track of global variables, type information, and imported entities (declarations
and namespaces).

.. _DIFile:

DIFile
""""""

``DIFile`` nodes represent files. The ``filename:`` can include slashes.

.. code-block:: none

!0 = !DIFile(filename: "path/to/file", directory: "/path/to/dir",
checksumkind: CSK_MD5,
checksum: "000102030405060708090a0b0c0d0e0f")

Files are sometimes used in ``scope:`` fields, and are the only valid target
for ``file:`` fields.
Valid values for ``checksumkind:`` field are: {CSK_None, CSK_MD5, CSK_SHA1, CSK_SHA256}

.. _DIBasicType:

DIBasicType
"""""""""""

``DIBasicType`` nodes represent primitive types, such as ``int``, ``bool`` and
``float``. ``tag:`` defaults to ``DW_TAG_base_type``.

.. code-block:: text

!0 = !DIBasicType(name: "unsigned char", size: 8, align: 8,
encoding: DW_ATE_unsigned_char)
!1 = !DIBasicType(tag: DW_TAG_unspecified_type, name: "decltype(nullptr)")

The ``encoding:`` describes the details of the type. Usually it's one of the
following:

.. code-block:: text

DW_ATE_address = 1
DW_ATE_boolean = 2
DW_ATE_float = 4
DW_ATE_signed = 5
DW_ATE_signed_char = 6
DW_ATE_unsigned = 7
DW_ATE_unsigned_char = 8

.. _DISubroutineType:

DISubroutineType
""""""""""""""""

``DISubroutineType`` nodes represent subroutine types. Their ``types:`` field
refers to a tuple; the first operand is the return type, while the rest are the
types of the formal arguments in order. If the first operand is ``null``, that
represents a function with no return value (such as ``void foo() {}`` in C++).

.. code-block:: text

!0 = !BasicType(name: "int", size: 32, align: 32, DW_ATE_signed)
!1 = !BasicType(name: "char", size: 8, align: 8, DW_ATE_signed_char)
!2 = !DISubroutineType(types: !{null, !0, !1}) ; void (int, char)

.. _DIDerivedType:

DIDerivedType
"""""""""""""

``DIDerivedType`` nodes represent types derived from other types, such as
qualified types.

.. code-block:: text

!0 = !DIBasicType(name: "unsigned char", size: 8, align: 8,
encoding: DW_ATE_unsigned_char)
!1 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !0, size: 32,
align: 32)

The following ``tag:`` values are valid:

.. code-block:: text

DW_TAG_member = 13
DW_TAG_pointer_type = 15
DW_TAG_reference_type = 16
DW_TAG_typedef = 22
DW_TAG_inheritance = 28
DW_TAG_ptr_to_member_type = 31
DW_TAG_const_type = 38
DW_TAG_friend = 42
DW_TAG_volatile_type = 53
DW_TAG_restrict_type = 55
DW_TAG_atomic_type = 71

.. _DIDerivedTypeMember:

``DW_TAG_member`` is used to define a member of a :ref:`composite type
`. The type of the member is the ``baseType:``. The
``offset:`` is the member's bit offset. If the composite type has an ODR
``identifier:`` and does not set ``flags: DIFwdDecl``, then the member is
uniqued based only on its ``name:`` and ``scope:``.

``DW_TAG_inheritance`` and ``DW_TAG_friend`` are used in the ``elements:``
field of :ref:`composite types ` to describe parents and
friends.

``DW_TAG_typedef`` is used to provide a name for the ``baseType:``.

``DW_TAG_pointer_type``, ``DW_TAG_reference_type``, ``DW_TAG_const_type``,
``DW_TAG_volatile_type``, ``DW_TAG_restrict_type`` and ``DW_TAG_atomic_type``
are used to qualify the ``baseType:``.

Note that the ``void *`` type is expressed as a type derived from NULL.

.. _DICompositeType:

DICompositeType
"""""""""""""""

``DICompositeType`` nodes represent types composed of other types, like
structures and unions. ``elements:`` points to a tuple of the composed types.

If the source language supports ODR, the ``identifier:`` field gives the unique
identifier used for type merging between modules. When specified,
:ref:`subprogram declarations ` and :ref:`member
derived types ` that reference the ODR-type in their
``scope:`` change uniquing rules.

For a given ``identifier:``, there should only be a single composite type that
does not have ``flags: DIFlagFwdDecl`` set. LLVM tools that link modules
together will unique such definitions at parse time via the ``identifier:``
field, even if the nodes are ``distinct``.

.. code-block:: text

!0 = !DIEnumerator(name: "SixKind", value: 7)
!1 = !DIEnumerator(name: "SevenKind", value: 7)
!2 = !DIEnumerator(name: "NegEightKind", value: -8)
!3 = !DICompositeType(tag: DW_TAG_enumeration_type, name: "Enum", file: !12,
line: 2, size: 32, align: 32, identifier: "_M4Enum",
elements: !{!0, !1, !2})

The following ``tag:`` values are valid:

.. code-block:: text

DW_TAG_array_type = 1
DW_TAG_class_type = 2
DW_TAG_enumeration_type = 4
DW_TAG_structure_type = 19
DW_TAG_union_type = 23

For ``DW_TAG_array_type``, the ``elements:`` should be :ref:`subrange
descriptors `, each representing the range of subscripts at that
level of indexing. The ``DIFlagVector`` flag to ``flags:`` indicates that an
array type is a native packed vector. The optional ``dataLocation`` is a
DIExpression that describes how to get from an object's address to the actual
raw data, if they aren't equivalent. This is only supported for array types,
particularly to describe Fortran arrays, which have an array descriptor in
addition to the array data. Alternatively it can also be DIVariable which
has the address of the actual raw data.

For ``DW_TAG_enumeration_type``, the ``elements:`` should be :ref:`enumerator
descriptors `, each representing the definition of an enumeration
value for the set. All enumeration type descriptors are collected in the
``enums:`` field of the :ref:`compile unit `.

For ``DW_TAG_structure_type``, ``DW_TAG_class_type``, and
``DW_TAG_union_type``, the ``elements:`` should be :ref:`derived types
` with ``tag: DW_TAG_member``, ``tag: DW_TAG_inheritance``, or
``tag: DW_TAG_friend``; or :ref:`subprograms ` with
``isDefinition: false``.

.. _DISubrange:

DISubrange
""""""""""

``DISubrange`` nodes are the elements for ``DW_TAG_array_type`` variants of
:ref:`DICompositeType`.

- ``count: -1`` indicates an empty array.
- ``count: !9`` describes the count with a :ref:`DILocalVariable`.
- ``count: !11`` describes the count with a :ref:`DIGlobalVariable`.

.. code-block:: text

!0 = !DISubrange(count: 5, lowerBound: 0) ; array counting from 0
!1 = !DISubrange(count: 5, lowerBound: 1) ; array counting from 1
!2 = !DISubrange(count: -1) ; empty array.

; Scopes used in rest of example
!6 = !DIFile(filename: "vla.c", directory: "/path/to/file")
!7 = distinct !DICompileUnit(language: DW_LANG_C99, file: !6)
!8 = distinct !DISubprogram(name: "foo", scope: !7, file: !6, line: 5)

; Use of local variable as count value
!9 = !DIBasicType(name: "int", size: 32, encoding: DW_ATE_signed)
!10 = !DILocalVariable(name: "count", scope: !8, file: !6, line: 42, type: !9)
!11 = !DISubrange(count: !10, lowerBound: 0)

; Use of global variable as count value
!12 = !DIGlobalVariable(name: "count", scope: !8, file: !6, line: 22, type: !9)
!13 = !DISubrange(count: !12, lowerBound: 0)

.. _DIEnumerator:

DIEnumerator
""""""""""""

``DIEnumerator`` nodes are the elements for ``DW_TAG_enumeration_type``
variants of :ref:`DICompositeType`.

.. code-block:: text

!0 = !DIEnumerator(name: "SixKind", value: 7)
!1 = !DIEnumerator(name: "SevenKind", value: 7)
!2 = !DIEnumerator(name: "NegEightKind", value: -8)

DITemplateTypeParameter
"""""""""""""""""""""""

``DITemplateTypeParameter`` nodes represent type parameters to generic source
language constructs. They are used (optionally) in :ref:`DICompositeType` and
:ref:`DISubprogram` ``templateParams:`` fields.

.. code-block:: text

!0 = !DITemplateTypeParameter(name: "Ty", type: !1)

DITemplateValueParameter
""""""""""""""""""""""""

``DITemplateValueParameter`` nodes represent value parameters to generic source
language constructs. ``tag:`` defaults to ``DW_TAG_template_value_parameter``,
but if specified can also be set to ``DW_TAG_GNU_template_template_param`` or
``DW_TAG_GNU_template_param_pack``. They are used (optionally) in
:ref:`DICompositeType` and :ref:`DISubprogram` ``templateParams:`` fields.

.. code-block:: text

!0 = !DITemplateValueParameter(name: "Ty", type: !1, value: i32 7)

DINamespace
"""""""""""

``DINamespace`` nodes represent namespaces in the source language.

.. code-block:: text

!0 = !DINamespace(name: "myawesomeproject", scope: !1, file: !2, line: 7)

.. _DIGlobalVariable:

DIGlobalVariable
""""""""""""""""

``DIGlobalVariable`` nodes represent global variables in the source language.

.. code-block:: text

@foo = global i32, !dbg !0
!0 = !DIGlobalVariableExpression(var: !1, expr: !DIExpression())
!1 = !DIGlobalVariable(name: "foo", linkageName: "foo", scope: !2,
file: !3, line: 7, type: !4, isLocal: true,
isDefinition: false, declaration: !5)

DIGlobalVariableExpression
""""""""""""""""""""""""""

``DIGlobalVariableExpression`` nodes tie a :ref:`DIGlobalVariable` together
with a :ref:`DIExpression`.

.. code-block:: text

@lower = global i32, !dbg !0
@upper = global i32, !dbg !1
!0 = !DIGlobalVariableExpression(
var: !2,
expr: !DIExpression(DW_OP_LLVM_fragment, 0, 32)
)
!1 = !DIGlobalVariableExpression(
var: !2,
expr: !DIExpression(DW_OP_LLVM_fragment, 32, 32)
)
!2 = !DIGlobalVariable(name: "split64", linkageName: "split64", scope: !3,
file: !4, line: 8, type: !5, declaration: !6)

All global variable expressions should be referenced by the `globals:` field of
a :ref:`compile unit `.

.. _DISubprogram:

DISubprogram
""""""""""""

``DISubprogram`` nodes represent functions from the source language. A
distinct ``DISubprogram`` may be attached to a function definition using
``!dbg`` metadata. A unique ``DISubprogram`` may be attached to a function
declaration used for call site debug info. The ``variables:`` field points at
:ref:`variables ` that must be retained, even if their IR
counterparts are optimized out of the IR. The ``type:`` field must point at an
:ref:`DISubroutineType`.

.. _DISubprogramDeclaration:

When ``isDefinition: false``, subprograms describe a declaration in the type
tree as opposed to a definition of a function. If the scope is a composite
type with an ODR ``identifier:`` and that does not set ``flags: DIFwdDecl``,
then the subprogram declaration is uniqued based only on its ``linkageName:``
and ``scope:``.

.. code-block:: text

define void @_Z3foov() !dbg !0 {
...
}

!0 = distinct !DISubprogram(name: "foo", linkageName: "_Zfoov", scope: !1,
file: !2, line: 7, type: !3, isLocal: true,
isDefinition: true, scopeLine: 8,
containingType: !4,
virtuality: DW_VIRTUALITY_pure_virtual,
virtualIndex: 10, flags: DIFlagPrototyped,
isOptimized: true, unit: !5, templateParams: !6,
declaration: !7, variables: !8, thrownTypes: !9)

.. _DILexicalBlock:

DILexicalBlock
""""""""""""""

``DILexicalBlock`` nodes describe nested blocks within a :ref:`subprogram
`. The line number and column numbers are used to distinguish
two lexical blocks at same depth. They are valid targets for ``scope:``
fields.

.. code-block:: text

!0 = distinct !DILexicalBlock(scope: !1, file: !2, line: 7, column: 35)

Usually lexical blocks are ``distinct`` to prevent node merging based on
operands.

.. _DILexicalBlockFile:

DILexicalBlockFile
""""""""""""""""""

``DILexicalBlockFile`` nodes are used to discriminate between sections of a
:ref:`lexical block `. The ``file:`` field can be changed to
indicate textual inclusion, or the ``discriminator:`` field can be used to
discriminate between control flow within a single block in the source language.

.. code-block:: text

!0 = !DILexicalBlock(scope: !3, file: !4, line: 7, column: 35)
!1 = !DILexicalBlockFile(scope: !0, file: !4, discriminator: 0)
!2 = !DILexicalBlockFile(scope: !0, file: !4, discriminator: 1)

.. _DILocation:

DILocation
""""""""""

``DILocation`` nodes represent source debug locations. The ``scope:`` field is
mandatory, and points at an :ref:`DILexicalBlockFile`, an
:ref:`DILexicalBlock`, or an :ref:`DISubprogram`.

.. code-block:: text

!0 = !DILocation(line: 2900, column: 42, scope: !1, inlinedAt: !2)

.. _DILocalVariable:

DILocalVariable
"""""""""""""""

``DILocalVariable`` nodes represent local variables in the source language. If
the ``arg:`` field is set to non-zero, then this variable is a subprogram
parameter, and it will be included in the ``variables:`` field of its
:ref:`DISubprogram`.

.. code-block:: text

!0 = !DILocalVariable(name: "this", arg: 1, scope: !3, file: !2, line: 7,
type: !3, flags: DIFlagArtificial)
!1 = !DILocalVariable(name: "x", arg: 2, scope: !4, file: !2, line: 7,
type: !3)
!2 = !DILocalVariable(name: "y", scope: !5, file: !2, line: 7, type: !3)

.. _DIExpression:

DIExpression
""""""""""""

``DIExpression`` nodes represent expressions that are inspired by the DWARF
expression language. They are used in :ref:`debug intrinsics`
(such as ``llvm.dbg.declare`` and ``llvm.dbg.value``) to describe how the
referenced LLVM variable relates to the source language variable. Debug
intrinsics are interpreted left-to-right: start by pushing the value/address
operand of the intrinsic onto a stack, then repeatedly push and evaluate
opcodes from the DIExpression until the final variable description is produced.

The current supported opcode vocabulary is limited:

- ``DW_OP_deref`` dereferences the top of the expression stack.
- ``DW_OP_plus`` pops the last two entries from the expression stack, adds
them together and appends the result to the expression stack.
- ``DW_OP_minus`` pops the last two entries from the expression stack, subtracts
the last entry from the second last entry and appends the result to the
expression stack.
- ``DW_OP_plus_uconst, 93`` adds ``93`` to the working expression.
- ``DW_OP_LLVM_fragment, 16, 8`` specifies the offset and size (``16`` and ``8``
here, respectively) of the variable fragment from the working expression. Note
that contrary to DW_OP_bit_piece, the offset is describing the location
within the described source variable.
- ``DW_OP_LLVM_convert, 16, DW_ATE_signed`` specifies a bit size and encoding
(``16`` and ``DW_ATE_signed`` here, respectively) to which the top of the
expression stack is to be converted. Maps into a ``DW_OP_convert`` operation
that references a base type constructed from the supplied values.
- ``DW_OP_LLVM_tag_offset, tag_offset`` specifies that a memory tag should be
optionally applied to the pointer. The memory tag is derived from the
given tag offset in an implementation-defined manner.
- ``DW_OP_swap`` swaps top two stack entries.
- ``DW_OP_xderef`` provides extended dereference mechanism. The entry at the top
of the stack is treated as an address. The second stack entry is treated as an
address space identifier.
- ``DW_OP_stack_value`` marks a constant value.
- ``DW_OP_LLVM_entry_value, N`` can only appear at the beginning of a
``DIExpression``, and it specifies that all register and memory read
operations for the debug value instruction's value/address operand and for
the ``(N - 1)`` operations immediately following the
``DW_OP_LLVM_entry_value`` refer to their respective values at function
entry. For example, ``!DIExpression(DW_OP_LLVM_entry_value, 1,
DW_OP_plus_uconst, 123, DW_OP_stack_value)`` specifies an expression where
the entry value of the debug value instruction's value/address operand is
pushed to the stack, and is added with 123. Due to framework limitations
``N`` can currently only be 1.

``DW_OP_LLVM_entry_value`` is only legal in MIR. The operation is introduced
by the ``LiveDebugValues`` pass; currently only for function parameters that
are unmodified throughout a function. Support is limited to function
parameter that are described as simple register location descriptions, or as
indirect locations (e.g. when a struct is passed-by-value to a callee via a
pointer to a temporary copy made in the caller). The entry value op is also
introduced by the ``AsmPrinter`` pass when a call site parameter value
(``DW_AT_call_site_parameter_value``) is represented as entry value of the
parameter.
- ``DW_OP_breg`` (or ``DW_OP_bregx``) represents a content on the provided
signed offset of the specified register. The opcode is only generated by the
``AsmPrinter`` pass to describe call site parameter value which requires an
expression over two registers.
- ``DW_OP_push_object_address`` pushes the address of the object which can then
serve as a descriptor in subsequent calculation. This opcode can be used to
calculate bounds of fortran allocatable array which has array descriptors.

DWARF specifies three kinds of simple location descriptions: Register, memory,
and implicit location descriptions. Note that a location description is
defined over certain ranges of a program, i.e the location of a variable may
change over the course of the program. Register and memory location
descriptions describe the *concrete location* of a source variable (in the
sense that a debugger might modify its value), whereas *implicit locations*
describe merely the actual *value* of a source variable which might not exist
in registers or in memory (see ``DW_OP_stack_value``).

A ``llvm.dbg.addr`` or ``llvm.dbg.declare`` intrinsic describes an indirect
value (the address) of a source variable. The first operand of the intrinsic
must be an address of some kind. A DIExpression attached to the intrinsic
refines this address to produce a concrete location for the source variable.

A ``llvm.dbg.value`` intrinsic describes the direct value of a source variable.
The first operand of the intrinsic may be a direct or indirect value. A
DIExpression attached to the intrinsic refines the first operand to produce a
direct value. For example, if the first operand is an indirect value, it may be
necessary to insert ``DW_OP_deref`` into the DIExpression in order to produce a
valid debug intrinsic.

.. note::

A DIExpression is interpreted in the same way regardless of which kind of
debug intrinsic it's attached to.

.. code-block:: text

!0 = !DIExpression(DW_OP_deref)
!1 = !DIExpression(DW_OP_plus_uconst, 3)
!1 = !DIExpression(DW_OP_constu, 3, DW_OP_plus)
!2 = !DIExpression(DW_OP_bit_piece, 3, 7)
!3 = !DIExpression(DW_OP_deref, DW_OP_constu, 3, DW_OP_plus, DW_OP_LLVM_fragment, 3, 7)
!4 = !DIExpression(DW_OP_constu, 2, DW_OP_swap, DW_OP_xderef)
!5 = !DIExpression(DW_OP_constu, 42, DW_OP_stack_value)

DIFlags
"""""""""""""""

These flags encode various properties of DINodes.

The `ExportSymbols` flag marks a class, struct or union whose members
may be referenced as if they were defined in the containing class or
union. This flag is used to decide whether the DW_AT_export_symbols can
be used for the structure type.

DIObjCProperty
""""""""""""""

``DIObjCProperty`` nodes represent Objective-C property nodes.

.. code-block:: text

!3 = !DIObjCProperty(name: "foo", file: !1, line: 7, setter: "setFoo",
getter: "getFoo", attributes: 7, type: !2)

DIImportedEntity
""""""""""""""""

``DIImportedEntity`` nodes represent entities (such as modules) imported into a
compile unit.

.. code-block:: text

!2 = !DIImportedEntity(tag: DW_TAG_imported_module, name: "foo", scope: !0,
entity: !1, line: 7)

DIMacro
"""""""

``DIMacro`` nodes represent definition or undefinition of a macro identifiers.
The ``name:`` field is the macro identifier, followed by macro parameters when
defining a function-like macro, and the ``value`` field is the token-string
used to expand the macro identifier.

.. code-block:: text

!2 = !DIMacro(macinfo: DW_MACINFO_define, line: 7, name: "foo(x)",
value: "((x) + 1)")
!3 = !DIMacro(macinfo: DW_MACINFO_undef, line: 30, name: "foo")

DIMacroFile
"""""""""""

``DIMacroFile`` nodes represent inclusion of source files.
The ``nodes:`` field is a list of ``DIMacro`` and ``DIMacroFile`` nodes that
appear in the included source file.

.. code-block:: text

!2 = !DIMacroFile(macinfo: DW_MACINFO_start_file, line: 7, file: !2,
nodes: !3)

'``tbaa``' Metadata
^^^^^^^^^^^^^^^^^^^

In LLVM IR, memory does not have types, so LLVM's own type system is not
suitable for doing type based alias analysis (TBAA). Instead, metadata is
added to the IR to describe a type system of a higher level language. This
can be used to implement C/C++ strict type aliasing rules, but it can also
be used to implement custom alias analysis behavior for other languages.

This description of LLVM's TBAA system is broken into two parts:
:ref:`Semantics` talks about high level issues, and
:ref:`Representation` talks about the metadata
encoding of various entities.

It is always possible to trace any TBAA node to a "root" TBAA node (details
in the :ref:`Representation` section). TBAA
nodes with different roots have an unknown aliasing relationship, and LLVM
conservatively infers ``MayAlias`` between them. The rules mentioned in
this section only pertain to TBAA nodes living under the same root.

.. _tbaa_node_semantics:

Semantics
"""""""""

The TBAA metadata system, referred to as "struct path TBAA" (not to be
confused with ``tbaa.struct``), consists of the following high level
concepts: *Type Descriptors*, further subdivided into scalar type
descriptors and struct type descriptors; and *Access Tags*.

**Type descriptors** describe the type system of the higher level language
being compiled. **Scalar type descriptors** describe types that do not
contain other types. Each scalar type has a parent type, which must also
be a scalar type or the TBAA root. Via this parent relation, scalar types
within a TBAA root form a tree. **Struct type descriptors** denote types
that contain a sequence of other type descriptors, at known offsets. These
contained type descriptors can either be struct type descriptors themselves
or scalar type descriptors.

**Access tags** are metadata nodes attached to load and store instructions.
Access tags use type descriptors to describe the *location* being accessed
in terms of the type system of the higher level language. Access tags are
tuples consisting of a base type, an access type and an offset. The base
type is a scalar type descriptor or a struct type descriptor, the access
type is a scalar type descriptor, and the offset is a constant integer.

The access tag ``(BaseTy, AccessTy, Offset)`` can describe one of two
things:

* If ``BaseTy`` is a struct type, the tag describes a memory access (load
or store) of a value of type ``AccessTy`` contained in the struct type
``BaseTy`` at offset ``Offset``.

* If ``BaseTy`` is a scalar type, ``Offset`` must be 0 and ``BaseTy`` and
``AccessTy`` must be the same; and the access tag describes a scalar
access with scalar type ``AccessTy``.

We first define an ``ImmediateParent`` relation on ``(BaseTy, Offset)``
tuples this way:

* If ``BaseTy`` is a scalar type then ``ImmediateParent(BaseTy, 0)`` is
``(ParentTy, 0)`` where ``ParentTy`` is the parent of the scalar type as
described in the TBAA metadata. ``ImmediateParent(BaseTy, Offset)`` is
undefined if ``Offset`` is non-zero.

* If ``BaseTy`` is a struct type then ``ImmediateParent(BaseTy, Offset)``
is ``(NewTy, NewOffset)`` where ``NewTy`` is the type contained in
``BaseTy`` at offset ``Offset`` and ``NewOffset`` is ``Offset`` adjusted
to be relative within that inner type.

A memory access with an access tag ``(BaseTy1, AccessTy1, Offset1)``
aliases a memory access with an access tag ``(BaseTy2, AccessTy2,
Offset2)`` if either ``(BaseTy1, Offset1)`` is reachable from ``(Base2,
Offset2)`` via the ``Parent`` relation or vice versa.

As a concrete example, the type descriptor graph for the following program

.. code-block:: c

struct Inner {
int i; // offset 0
float f; // offset 4
};

struct Outer {
float f; // offset 0
double d; // offset 4
struct Inner inner_a; // offset 12
};

void f(struct Outer* outer, struct Inner* inner, float* f, int* i, char* c) {
outer->f = 0; // tag0: (OuterStructTy, FloatScalarTy, 0)
outer->inner_a.i = 0; // tag1: (OuterStructTy, IntScalarTy, 12)
outer->inner_a.f = 0.0; // tag2: (OuterStructTy, FloatScalarTy, 16)
*f = 0.0; // tag3: (FloatScalarTy, FloatScalarTy, 0)
}

is (note that in C and C++, ``char`` can be used to access any arbitrary
type):

.. code-block:: text

Root = "TBAA Root"
CharScalarTy = ("char", Root, 0)
FloatScalarTy = ("float", CharScalarTy, 0)
DoubleScalarTy = ("double", CharScalarTy, 0)
IntScalarTy = ("int", CharScalarTy, 0)
InnerStructTy = {"Inner" (IntScalarTy, 0), (FloatScalarTy, 4)}
OuterStructTy = {"Outer", (FloatScalarTy, 0), (DoubleScalarTy, 4),
(InnerStructTy, 12)}

with (e.g.) ``ImmediateParent(OuterStructTy, 12)`` = ``(InnerStructTy,
0)``, ``ImmediateParent(InnerStructTy, 0)`` = ``(IntScalarTy, 0)``, and
``ImmediateParent(IntScalarTy, 0)`` = ``(CharScalarTy, 0)``.

.. _tbaa_node_representation:

Representation
""""""""""""""

The root node of a TBAA type hierarchy is an ``MDNode`` with 0 operands or
with exactly one ``MDString`` operand.

Scalar type descriptors are represented as an ``MDNode`` s with two
operands. The first operand is an ``MDString`` denoting the name of the
struct type. LLVM does not assign meaning to the value of this operand, it
only cares about it being an ``MDString``. The second operand is an
``MDNode`` which points to the parent for said scalar type descriptor,
which is either another scalar type descriptor or the TBAA root. Scalar
type descriptors can have an optional third argument, but that must be the
constant integer zero.

Struct type descriptors are represented as ``MDNode`` s with an odd number
of operands greater than 1. The first operand is an ``MDString`` denoting
the name of the struct type. Like in scalar type descriptors the actual
value of this name operand is irrelevant to LLVM. After the name operand,
the struct type descriptors have a sequence of alternating ``MDNode`` and
``ConstantInt`` operands. With N starting from 1, the 2N - 1 th operand,
an ``MDNode``, denotes a contained field, and the 2N th operand, a
``ConstantInt``, is the offset of the said contained field. The offsets
must be in non-decreasing order.

Access tags are represented as ``MDNode`` s with either 3 or 4 operands.
The first operand is an ``MDNode`` pointing to the node representing the
base type. The second operand is an ``MDNode`` pointing to the node
representing the access type. The third operand is a ``ConstantInt`` that
states the offset of the access. If a fourth field is present, it must be
a ``ConstantInt`` valued at 0 or 1. If it is 1 then the access tag states
that the location being accessed is "constant" (meaning
``pointsToConstantMemory`` should return true; see `other useful
AliasAnalysis methods `_). The TBAA root of
the access type and the base type of an access tag must be the same, and
that is the TBAA root of the access tag.

'``tbaa.struct``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^

The :ref:`llvm.memcpy ` is often used to implement
aggregate assignment operations in C and similar languages, however it
is defined to copy a contiguous region of memory, which is more than
strictly necessary for aggregate types which contain holes due to
padding. Also, it doesn't contain any TBAA information about the fields
of the aggregate.

``!tbaa.struct`` metadata can describe which memory subregions in a
memcpy are padding and what the TBAA tags of the struct are.

The current metadata format is very simple. ``!tbaa.struct`` metadata
nodes are a list of operands which are in conceptual groups of three.
For each group of three, the first operand gives the byte offset of a
field in bytes, the second gives its size in bytes, and the third gives
its tbaa tag. e.g.:

.. code-block:: llvm

!4 = !{ i64 0, i64 4, !1, i64 8, i64 4, !2 }

This describes a struct with two fields. The first is at offset 0 bytes
with size 4 bytes, and has tbaa tag !1. The second is at offset 8 bytes
and has size 4 bytes and has tbaa tag !2.

Note that the fields need not be contiguous. In this example, there is a
4 byte gap between the two fields. This gap represents padding which
does not carry useful data and need not be preserved.

'``noalias``' and '``alias.scope``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

``noalias`` and ``alias.scope`` metadata provide the ability to specify generic
noalias memory-access sets. This means that some collection of memory access
instructions (loads, stores, memory-accessing calls, etc.) that carry
``noalias`` metadata can specifically be specified not to alias with some other
collection of memory access instructions that carry ``alias.scope`` metadata.
Each type of metadata specifies a list of scopes where each scope has an id and
a domain.

When evaluating an aliasing query, if for some domain, the set
of scopes with that domain in one instruction's ``alias.scope`` list is a
subset of (or equal to) the set of scopes for that domain in another
instruction's ``noalias`` list, then the two memory accesses are assumed not to
alias.

Because scopes in one domain don't affect scopes in other domains, separate
domains can be used to compose multiple independent noalias sets. This is
used for example during inlining. As the noalias function parameters are
turned into noalias scope metadata, a new domain is used every time the
function is inlined.

The metadata identifying each domain is itself a list containing one or two
entries. The first entry is the name of the domain. Note that if the name is a
string then it can be combined across functions and translation units. A
self-reference can be used to create globally unique domain names. A
descriptive string may optionally be provided as a second list entry.

The metadata identifying each scope is also itself a list containing two or
three entries. The first entry is the name of the scope. Note that if the name
is a string then it can be combined across functions and translation units. A
self-reference can be used to create globally unique scope names. A metadata
reference to the scope's domain is the second entry. A descriptive string may
optionally be provided as a third list entry.

For example,

.. code-block:: llvm

; Two scope domains:
!0 = !{!0}
!1 = !{!1}

; Some scopes in these domains:
!2 = !{!2, !0}
!3 = !{!3, !0}
!4 = !{!4, !1}

; Some scope lists:
!5 = !{!4} ; A list containing only scope !4
!6 = !{!4, !3, !2}
!7 = !{!3}

; These two instructions don't alias:
%0 = load float, float* %c, align 4, !alias.scope !5
store float %0, float* %arrayidx.i, align 4, !noalias !5

; These two instructions also don't alias (for domain !1, the set of scopes
; in the !alias.scope equals that in the !noalias list):
%2 = load float, float* %c, align 4, !alias.scope !5
store float %2, float* %arrayidx.i2, align 4, !noalias !6

; These two instructions may alias (for domain !0, the set of scopes in
; the !noalias list is not a superset of, or equal to, the scopes in the
; !alias.scope list):
%2 = load float, float* %c, align 4, !alias.scope !6
store float %0, float* %arrayidx.i, align 4, !noalias !7

'``fpmath``' Metadata
^^^^^^^^^^^^^^^^^^^^^

``fpmath`` metadata may be attached to any instruction of floating-point
type. It can be used to express the maximum acceptable error in the
result of that instruction, in ULPs, thus potentially allowing the
compiler to use a more efficient but less accurate method of computing
it. ULP is defined as follows:

If ``x`` is a real number that lies between two finite consecutive
floating-point numbers ``a`` and ``b``, without being equal to one
of them, then ``ulp(x) = |b - a|``, otherwise ``ulp(x)`` is the
distance between the two non-equal finite floating-point numbers
nearest ``x``. Moreover, ``ulp(NaN)`` is ``NaN``.

The metadata node shall consist of a single positive float type number
representing the maximum relative error, for example:

.. code-block:: llvm

!0 = !{ float 2.5 } ; maximum acceptable inaccuracy is 2.5 ULPs

.. _range-metadata:

'``range``' Metadata
^^^^^^^^^^^^^^^^^^^^

``range`` metadata may be attached only to ``load``, ``call`` and ``invoke`` of
integer types. It expresses the possible ranges the loaded value or the value
returned by the called function at this call site is in. If the loaded or
returned value is not in the specified range, the behavior is undefined. The
ranges are represented with a flattened list of integers. The loaded value or
the value returned is known to be in the union of the ranges defined by each
consecutive pair. Each pair has the following properties:

- The type must match the type loaded by the instruction.
- The pair ``a,b`` represents the range ``[a,b)``.
- Both ``a`` and ``b`` are constants.
- The range is allowed to wrap.
- The range should not represent the full or empty set. That is,
``a!=b``.

In addition, the pairs must be in signed order of the lower bound and
they must be non-contiguous.

Examples:

.. code-block:: llvm

%a = load i8, i8* %x, align 1, !range !0 ; Can only be 0 or 1
%b = load i8, i8* %y, align 1, !range !1 ; Can only be 255 (-1), 0 or 1
%c = call i8 @foo(), !range !2 ; Can only be 0, 1, 3, 4 or 5
%d = invoke i8 @bar() to label %cont
unwind label %lpad, !range !3 ; Can only be -2, -1, 3, 4 or 5
...
!0 = !{ i8 0, i8 2 }
!1 = !{ i8 255, i8 2 }
!2 = !{ i8 0, i8 2, i8 3, i8 6 }
!3 = !{ i8 -2, i8 0, i8 3, i8 6 }

'``absolute_symbol``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

``absolute_symbol`` metadata may be attached to a global variable
declaration. It marks the declaration as a reference to an absolute symbol,
which causes the backend to use absolute relocations for the symbol even
in position independent code, and expresses the possible ranges that the
global variable's *address* (not its value) is in, in the same format as
``range`` metadata, with the extension that the pair ``all-ones,all-ones``
may be used to represent the full set.

Example (assuming 64-bit pointers):

.. code-block:: llvm

@a = external global i8, !absolute_symbol !0 ; Absolute symbol in range [0,256)
@b = external global i8, !absolute_symbol !1 ; Absolute symbol in range [0,2^64)

...
!0 = !{ i64 0, i64 256 }
!1 = !{ i64 -1, i64 -1 }

'``callees``' Metadata
^^^^^^^^^^^^^^^^^^^^^^

``callees`` metadata may be attached to indirect call sites. If ``callees``
metadata is attached to a call site, and any callee is not among the set of
functions provided by the metadata, the behavior is undefined. The intent of
this metadata is to facilitate optimizations such as indirect-call promotion.
For example, in the code below, the call instruction may only target the
``add`` or ``sub`` functions:

.. code-block:: llvm

%result = call i64 %binop(i64 %x, i64 %y), !callees !0

...
!0 = !{i64 (i64, i64)* @add, i64 (i64, i64)* @sub}

'``callback``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^

``callback`` metadata may be attached to a function declaration, or definition.
(Call sites are excluded only due to the lack of a use case.) For ease of
exposition, we'll refer to the function annotated w/ metadata as a broker
function. The metadata describes how the arguments of a call to the broker are
in turn passed to the callback function specified by the metadata. Thus, the
``callback`` metadata provides a partial description of a call site inside the
broker function with regards to the arguments of a call to the broker. The only
semantic restriction on the broker function itself is that it is not allowed to
inspect or modify arguments referenced in the ``callback`` metadata as
pass-through to the callback function.

The broker is not required to actually invoke the callback function at runtime.
However, the assumptions about not inspecting or modifying arguments that would
be passed to the specified callback function still hold, even if the callback
function is not dynamically invoked. The broker is allowed to invoke the
callback function more than once per invocation of the broker. The broker is
also allowed to invoke (directly or indirectly) the function passed as a
callback through another use. Finally, the broker is also allowed to relay the
callback callee invocation to a different thread.

The metadata is structured as follows: At the outer level, ``callback``
metadata is a list of ``callback`` encodings. Each encoding starts with a
constant ``i64`` which describes the argument position of the callback function
in the call to the broker. The following elements, except the last, describe
what arguments are passed to the callback function. Each element is again an
``i64`` constant identifying the argument of the broker that is passed through,
or ``i64 -1`` to indicate an unknown or inspected argument. The order in which
they are listed has to be the same in which they are passed to the callback
callee. The last element of the encoding is a boolean which specifies how
variadic arguments of the broker are handled. If it is true, all variadic
arguments of the broker are passed through to the callback function *after* the
arguments encoded explicitly before.

In the code below, the ``pthread_create`` function is marked as a broker
through the ``!callback !1`` metadata. In the example, there is only one
callback encoding, namely ``!2``, associated with the broker. This encoding
identifies the callback function as the second argument of the broker (``i64
2``) and the sole argument of the callback function as the third one of the
broker function (``i64 3``).

.. FIXME why does the llvm-sphinx-docs builder give a highlighting
error if the below is set to highlight as 'llvm', despite that we
have misc.highlighting_failure set?

.. code-block:: text

declare !callback !1 dso_local i32 @pthread_create(i64*, %union.pthread_attr_t*, i8* (i8*)*, i8*)

...
!2 = !{i64 2, i64 3, i1 false}
!1 = !{!2}

Another example is shown below. The callback callee is the second argument of
the ``__kmpc_fork_call`` function (``i64 2``). The callee is given two unknown
values (each identified by a ``i64 -1``) and afterwards all
variadic arguments that are passed to the ``__kmpc_fork_call`` call (due to the
final ``i1 true``).

.. FIXME why does the llvm-sphinx-docs builder give a highlighting
error if the below is set to highlight as 'llvm', despite that we
have misc.highlighting_failure set?

.. code-block:: text

declare !callback !0 dso_local void @__kmpc_fork_call(%struct.ident_t*, i32, void (i32*, i32*, ...)*, ...)

...
!1 = !{i64 2, i64 -1, i64 -1, i1 true}
!0 = !{!1}

'``unpredictable``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^

``unpredictable`` metadata may be attached to any branch or switch
instruction. It can be used to express the unpredictability of control
flow. Similar to the llvm.expect intrinsic, it may be used to alter
optimizations related to compare and branch instructions. The metadata
is treated as a boolean value; if it exists, it signals that the branch
or switch that it is attached to is completely unpredictable.

.. _md_dereferenceable:

'``dereferenceable``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

The existence of the ``!dereferenceable`` metadata on the instruction
tells the optimizer that the value loaded is known to be dereferenceable.
The number of bytes known to be dereferenceable is specified by the integer
value in the metadata node. This is analogous to the ''dereferenceable''
attribute on parameters and return values.

.. _md_dereferenceable_or_null:

'``dereferenceable_or_null``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

The existence of the ``!dereferenceable_or_null`` metadata on the
instruction tells the optimizer that the value loaded is known to be either
dereferenceable or null.
The number of bytes known to be dereferenceable is specified by the integer
value in the metadata node. This is analogous to the ''dereferenceable_or_null''
attribute on parameters and return values.

.. _llvm.loop:

'``llvm.loop``'
^^^^^^^^^^^^^^^

It is sometimes useful to attach information to loop constructs. Currently,
loop metadata is implemented as metadata attached to the branch instruction
in the loop latch block. The loop metadata node is a list of
other metadata nodes, each representing a property of the loop. Usually,
the first item of the property node is a string. For example, the
``llvm.loop.unroll.count`` suggests an unroll factor to the loop
unroller:

.. code-block:: llvm

br i1 %exitcond, label %._crit_edge, label %.lr.ph, !llvm.loop !0
...
!0 = !{!0, !1, !2}
!1 = !{!"llvm.loop.unroll.enable"}
!2 = !{!"llvm.loop.unroll.count", i32 4}

For legacy reasons, the first item of a loop metadata node must be a
reference to itself. Before the advent of the 'distinct' keyword, this
forced the preservation of otherwise identical metadata nodes. Since
the loop-metadata node can be attached to multiple nodes, the 'distinct'
keyword has become unnecessary.

Prior to the property nodes, one or two ``DILocation`` (debug location)
nodes can be present in the list. The first, if present, identifies the
source-code location where the loop begins. The second, if present,
identifies the source-code location where the loop ends.

Loop metadata nodes cannot be used as unique identifiers. They are
neither persistent for the same loop through transformations nor
necessarily unique to just one loop.

'``llvm.loop.disable_nonforced``'
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata disables all optional loop transformations unless
explicitly instructed using other transformation metadata such as
``llvm.loop.unroll.enable``. That is, no heuristic will try to determine
whether a transformation is profitable. The purpose is to avoid that the
loop is transformed to a different loop before an explicitly requested
(forced) transformation is applied. For instance, loop fusion can make
other transformations impossible. Mandatory loop canonicalizations such
as loop rotation are still applied.

It is recommended to use this metadata in addition to any llvm.loop.*
transformation directive. Also, any loop should have at most one
directive applied to it (and a sequence of transformations built using
followup-attributes). Otherwise, which transformation will be applied
depends on implementation details such as the pass pipeline order.

See :ref:`transformation-metadata` for details.

'``llvm.loop.vectorize``' and '``llvm.loop.interleave``'
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Metadata prefixed with ``llvm.loop.vectorize`` or ``llvm.loop.interleave`` are
used to control per-loop vectorization and interleaving parameters such as
vectorization width and interleave count. These metadata should be used in
conjunction with ``llvm.loop`` loop identification metadata. The
``llvm.loop.vectorize`` and ``llvm.loop.interleave`` metadata are only
optimization hints and the optimizer will only interleave and vectorize loops if
it believes it is safe to do so. The ``llvm.loop.parallel_accesses`` metadata
which contains information about loop-carried memory dependencies can be helpful
in determining the safety of these transformations.

'``llvm.loop.interleave.count``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata suggests an interleave count to the loop interleaver.
The first operand is the string ``llvm.loop.interleave.count`` and the
second operand is an integer specifying the interleave count. For
example:

.. code-block:: llvm

!0 = !{!"llvm.loop.interleave.count", i32 4}

Note that setting ``llvm.loop.interleave.count`` to 1 disables interleaving
multiple iterations of the loop. If ``llvm.loop.interleave.count`` is set to 0
then the interleave count will be determined automatically.

'``llvm.loop.vectorize.enable``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata selectively enables or disables vectorization for the loop. The
first operand is the string ``llvm.loop.vectorize.enable`` and the second operand
is a bit. If the bit operand value is 1 vectorization is enabled. A value of
0 disables vectorization:

.. code-block:: llvm

!0 = !{!"llvm.loop.vectorize.enable", i1 0}
!1 = !{!"llvm.loop.vectorize.enable", i1 1}

'``llvm.loop.vectorize.predicate.enable``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata selectively enables or disables creating predicated instructions
for the loop, which can enable folding of the scalar epilogue loop into the
main loop. The first operand is the string
``llvm.loop.vectorize.predicate.enable`` and the second operand is a bit. If
the bit operand value is 1 vectorization is enabled. A value of 0 disables
vectorization:

.. code-block:: llvm

!0 = !{!"llvm.loop.vectorize.predicate.enable", i1 0}
!1 = !{!"llvm.loop.vectorize.predicate.enable", i1 1}

'``llvm.loop.vectorize.width``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata sets the target width of the vectorizer. The first
operand is the string ``llvm.loop.vectorize.width`` and the second
operand is an integer specifying the width. For example:

.. code-block:: llvm

!0 = !{!"llvm.loop.vectorize.width", i32 4}

Note that setting ``llvm.loop.vectorize.width`` to 1 disables
vectorization of the loop. If ``llvm.loop.vectorize.width`` is set to
0 or if the loop does not have this metadata the width will be
determined automatically.

'``llvm.loop.vectorize.followup_vectorized``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata defines which loop attributes the vectorized loop will
have. See :ref:`transformation-metadata` for details.

'``llvm.loop.vectorize.followup_epilogue``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata defines which loop attributes the epilogue will have. The
epilogue is not vectorized and is executed when either the vectorized
loop is not known to preserve semantics (because e.g., it processes two
arrays that are found to alias by a runtime check) or for the last
iterations that do not fill a complete set of vector lanes. See
:ref:`Transformation Metadata ` for details.

'``llvm.loop.vectorize.followup_all``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Attributes in the metadata will be added to both the vectorized and
epilogue loop.
See :ref:`Transformation Metadata ` for details.

'``llvm.loop.unroll``'
^^^^^^^^^^^^^^^^^^^^^^

Metadata prefixed with ``llvm.loop.unroll`` are loop unrolling
optimization hints such as the unroll factor. ``llvm.loop.unroll``
metadata should be used in conjunction with ``llvm.loop`` loop
identification metadata. The ``llvm.loop.unroll`` metadata are only
optimization hints and the unrolling will only be performed if the
optimizer believes it is safe to do so.

'``llvm.loop.unroll.count``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata suggests an unroll factor to the loop unroller. The
first operand is the string ``llvm.loop.unroll.count`` and the second
operand is a positive integer specifying the unroll factor. For
example:

.. code-block:: llvm

!0 = !{!"llvm.loop.unroll.count", i32 4}

If the trip count of the loop is less than the unroll count the loop
will be partially unrolled.

'``llvm.loop.unroll.disable``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata disables loop unrolling. The metadata has a single operand
which is the string ``llvm.loop.unroll.disable``. For example:

.. code-block:: llvm

!0 = !{!"llvm.loop.unroll.disable"}

'``llvm.loop.unroll.runtime.disable``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata disables runtime loop unrolling. The metadata has a single
operand which is the string ``llvm.loop.unroll.runtime.disable``. For example:

.. code-block:: llvm

!0 = !{!"llvm.loop.unroll.runtime.disable"}

'``llvm.loop.unroll.enable``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata suggests that the loop should be fully unrolled if the trip count
is known at compile time and partially unrolled if the trip count is not known
at compile time. The metadata has a single operand which is the string
``llvm.loop.unroll.enable``. For example:

.. code-block:: llvm

!0 = !{!"llvm.loop.unroll.enable"}

'``llvm.loop.unroll.full``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata suggests that the loop should be unrolled fully. The
metadata has a single operand which is the string ``llvm.loop.unroll.full``.
For example:

.. code-block:: llvm

!0 = !{!"llvm.loop.unroll.full"}

'``llvm.loop.unroll.followup``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata defines which loop attributes the unrolled loop will have.
See :ref:`Transformation Metadata ` for details.

'``llvm.loop.unroll.followup_remainder``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata defines which loop attributes the remainder loop after
partial/runtime unrolling will have. See
:ref:`Transformation Metadata ` for details.

'``llvm.loop.unroll_and_jam``'
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata is treated very similarly to the ``llvm.loop.unroll`` metadata
above, but affect the unroll and jam pass. In addition any loop with
``llvm.loop.unroll`` metadata but no ``llvm.loop.unroll_and_jam`` metadata will
disable unroll and jam (so ``llvm.loop.unroll`` metadata will be left to the
unroller, plus ``llvm.loop.unroll.disable`` metadata will disable unroll and jam
too.)

The metadata for unroll and jam otherwise is the same as for ``unroll``.
``llvm.loop.unroll_and_jam.enable``, ``llvm.loop.unroll_and_jam.disable`` and
``llvm.loop.unroll_and_jam.count`` do the same as for unroll.
``llvm.loop.unroll_and_jam.full`` is not supported. Again these are only hints
and the normal safety checks will still be performed.

'``llvm.loop.unroll_and_jam.count``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata suggests an unroll and jam factor to use, similarly to
``llvm.loop.unroll.count``. The first operand is the string
``llvm.loop.unroll_and_jam.count`` and the second operand is a positive integer
specifying the unroll factor. For example:

.. code-block:: llvm

!0 = !{!"llvm.loop.unroll_and_jam.count", i32 4}

If the trip count of the loop is less than the unroll count the loop
will be partially unroll and jammed.

'``llvm.loop.unroll_and_jam.disable``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata disables loop unroll and jamming. The metadata has a single
operand which is the string ``llvm.loop.unroll_and_jam.disable``. For example:

.. code-block:: llvm

!0 = !{!"llvm.loop.unroll_and_jam.disable"}

'``llvm.loop.unroll_and_jam.enable``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata suggests that the loop should be fully unroll and jammed if the
trip count is known at compile time and partially unrolled if the trip count is
not known at compile time. The metadata has a single operand which is the
string ``llvm.loop.unroll_and_jam.enable``. For example:

.. code-block:: llvm

!0 = !{!"llvm.loop.unroll_and_jam.enable"}

'``llvm.loop.unroll_and_jam.followup_outer``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata defines which loop attributes the outer unrolled loop will
have. See :ref:`Transformation Metadata ` for
details.

'``llvm.loop.unroll_and_jam.followup_inner``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata defines which loop attributes the inner jammed loop will
have. See :ref:`Transformation Metadata ` for
details.

'``llvm.loop.unroll_and_jam.followup_remainder_outer``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata defines which attributes the epilogue of the outer loop
will have. This loop is usually unrolled, meaning there is no such
loop. This attribute will be ignored in this case. See
:ref:`Transformation Metadata ` for details.

'``llvm.loop.unroll_and_jam.followup_remainder_inner``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata defines which attributes the inner loop of the epilogue
will have. The outer epilogue will usually be unrolled, meaning there
can be multiple inner remainder loops. See
:ref:`Transformation Metadata ` for details.

'``llvm.loop.unroll_and_jam.followup_all``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Attributes specified in the metadata is added to all
``llvm.loop.unroll_and_jam.*`` loops. See
:ref:`Transformation Metadata ` for details.

'``llvm.loop.licm_versioning.disable``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata indicates that the loop should not be versioned for the purpose
of enabling loop-invariant code motion (LICM). The metadata has a single operand
which is the string ``llvm.loop.licm_versioning.disable``. For example:

.. code-block:: llvm

!0 = !{!"llvm.loop.licm_versioning.disable"}

'``llvm.loop.distribute.enable``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Loop distribution allows splitting a loop into multiple loops. Currently,
this is only performed if the entire loop cannot be vectorized due to unsafe
memory dependencies. The transformation will attempt to isolate the unsafe
dependencies into their own loop.

This metadata can be used to selectively enable or disable distribution of the
loop. The first operand is the string ``llvm.loop.distribute.enable`` and the
second operand is a bit. If the bit operand value is 1 distribution is
enabled. A value of 0 disables distribution:

.. code-block:: llvm

!0 = !{!"llvm.loop.distribute.enable", i1 0}
!1 = !{!"llvm.loop.distribute.enable", i1 1}

This metadata should be used in conjunction with ``llvm.loop`` loop
identification metadata.

'``llvm.loop.distribute.followup_coincident``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata defines which attributes extracted loops with no cyclic
dependencies will have (i.e. can be vectorized). See
:ref:`Transformation Metadata ` for details.

'``llvm.loop.distribute.followup_sequential``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata defines which attributes the isolated loops with unsafe
memory dependencies will have. See
:ref:`Transformation Metadata ` for details.

'``llvm.loop.distribute.followup_fallback``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

If loop versioning is necessary, this metadata defined the attributes
the non-distributed fallback version will have. See
:ref:`Transformation Metadata ` for details.

'``llvm.loop.distribute.followup_all``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

The attributes in this metadata is added to all followup loops of the
loop distribution pass. See
:ref:`Transformation Metadata ` for details.

'``llvm.licm.disable``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This metadata indicates that loop-invariant code motion (LICM) should not be
performed on this loop. The metadata has a single operand which is the string
``llvm.licm.disable``. For example:

.. code-block:: llvm

!0 = !{!"llvm.licm.disable"}

Note that although it operates per loop it isn't given the llvm.loop prefix
as it is not affected by the ``llvm.loop.disable_nonforced`` metadata.

'``llvm.access.group``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

``llvm.access.group`` metadata can be attached to any instruction that
potentially accesses memory. It can point to a single distinct metadata
node, which we call access group. This node represents all memory access
instructions referring to it via ``llvm.access.group``. When an
instruction belongs to multiple access groups, it can also point to a
list of accesses groups, illustrated by the following example.

.. code-block:: llvm

%val = load i32, i32* %arrayidx, !llvm.access.group !0
...
!0 = !{!1, !2}
!1 = distinct !{}
!2 = distinct !{}

It is illegal for the list node to be empty since it might be confused
with an access group.

The access group metadata node must be 'distinct' to avoid collapsing
multiple access groups by content. A access group metadata node must
always be empty which can be used to distinguish an access group
metadata node from a list of access groups. Being empty avoids the
situation that the content must be updated which, because metadata is
immutable by design, would required finding and updating all references
to the access group node.

The access group can be used to refer to a memory access instruction
without pointing to it directly (which is not possible in global
metadata). Currently, the only metadata making use of it is
``llvm.loop.parallel_accesses``.

'``llvm.loop.parallel_accesses``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

The ``llvm.loop.parallel_accesses`` metadata refers to one or more
access group metadata nodes (see ``llvm.access.group``). It denotes that
no loop-carried memory dependence exist between it and other instructions
in the loop with this metadata.

Let ``m1`` and ``m2`` be two instructions that both have the
``llvm.access.group`` metadata to the access group ``g1``, respectively
``g2`` (which might be identical). If a loop contains both access groups
in its ``llvm.loop.parallel_accesses`` metadata, then the compiler can
assume that there is no dependency between ``m1`` and ``m2`` carried by
this loop. Instructions that belong to multiple access groups are
considered having this property if at least one of the access groups
matches the ``llvm.loop.parallel_accesses`` list.

If all memory-accessing instructions in a loop have
``llvm.loop.parallel_accesses`` metadata that refers to that loop, then the
loop has no loop carried memory dependences and is considered to be a
parallel loop.

Note that if not all memory access instructions belong to an access
group referred to by ``llvm.loop.parallel_accesses``, then the loop must
not be considered trivially parallel. Additional
memory dependence analysis is required to make that determination. As a fail
safe mechanism, this causes loops that were originally parallel to be considered
sequential (if optimization passes that are unaware of the parallel semantics
insert new memory instructions into the loop body).

Example of a loop that is considered parallel due to its correct use of
both ``llvm.access.group`` and ``llvm.loop.parallel_accesses``
metadata types.

.. code-block:: llvm

for.body:
...
%val0 = load i32, i32* %arrayidx, !llvm.access.group !1
...
store i32 %val0, i32* %arrayidx1, !llvm.access.group !1
...
br i1 %exitcond, label %for.end, label %for.body, !llvm.loop !0

for.end:
...
!0 = distinct !{!0, !{!"llvm.loop.parallel_accesses", !1}}
!1 = distinct !{}

It is also possible to have nested parallel loops:

.. code-block:: llvm

outer.for.body:
...
%val1 = load i32, i32* %arrayidx3, !llvm.access.group !4
...
br label %inner.for.body

inner.for.body:
...
%val0 = load i32, i32* %arrayidx1, !llvm.access.group !3
...
store i32 %val0, i32* %arrayidx2, !llvm.access.group !3
...
br i1 %exitcond, label %inner.for.end, label %inner.for.body, !llvm.loop !1

inner.for.end:
...
store i32 %val1, i32* %arrayidx4, !llvm.access.group !4
...
br i1 %exitcond, label %outer.for.end, label %outer.for.body, !llvm.loop !2

outer.for.end: ; preds = %for.body
...
!1 = distinct !{!1, !{!"llvm.loop.parallel_accesses", !3}} ; metadata for the inner loop
!2 = distinct !{!2, !{!"llvm.loop.parallel_accesses", !3, !4}} ; metadata for the outer loop
!3 = distinct !{} ; access group for instructions in the inner loop (which are implicitly contained in outer loop as well)
!4 = distinct !{} ; access group for instructions in the outer, but not the inner loop

'``irr_loop``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^

``irr_loop`` metadata may be attached to the terminator instruction of a basic
block that's an irreducible loop header (note that an irreducible loop has more
than once header basic blocks.) If ``irr_loop`` metadata is attached to the
terminator instruction of a basic block that is not really an irreducible loop
header, the behavior is undefined. The intent of this metadata is to improve the
accuracy of the block frequency propagation. For example, in the code below, the
block ``header0`` may have a loop header weight (relative to the other headers of
the irreducible loop) of 100:

.. code-block:: llvm

header0:
...
br i1 %cmp, label %t1, label %t2, !irr_loop !0

...
!0 = !{"loop_header_weight", i64 100}

Irreducible loop header weights are typically based on profile data.

.. _md_invariant.group:

'``invariant.group``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

The experimental ``invariant.group`` metadata may be attached to
``load``/``store`` instructions referencing a single metadata with no entries.
The existence of the ``invariant.group`` metadata on the instruction tells
the optimizer that every ``load`` and ``store`` to the same pointer operand
can be assumed to load or store the same
value (but see the ``llvm.launder.invariant.group`` intrinsic which affects
when two pointers are considered the same). Pointers returned by bitcast or
getelementptr with only zero indices are considered the same.

Examples:

.. code-block:: llvm

@unknownPtr = external global i8
...
%ptr = alloca i8
store i8 42, i8* %ptr, !invariant.group !0
call void @foo(i8* %ptr)

%a = load i8, i8* %ptr, !invariant.group !0 ; Can assume that value under %ptr didn't change
call void @foo(i8* %ptr)

%newPtr = call i8* @getPointer(i8* %ptr)
%c = load i8, i8* %newPtr, !invariant.group !0 ; Can't assume anything, because we only have information about %ptr

%unknownValue = load i8, i8* @unknownPtr
store i8 %unknownValue, i8* %ptr, !invariant.group !0 ; Can assume that %unknownValue == 42

call void @foo(i8* %ptr)
%newPtr2 = call i8* @llvm.launder.invariant.group(i8* %ptr)
%d = load i8, i8* %newPtr2, !invariant.group !0 ; Can't step through launder.invariant.group to get value of %ptr

...
declare void @foo(i8*)
declare i8* @getPointer(i8*)
declare i8* @llvm.launder.invariant.group(i8*)

!0 = !{}

The invariant.group metadata must be dropped when replacing one pointer by
another based on aliasing information. This is because invariant.group is tied
to the SSA value of the pointer operand.

.. code-block:: llvm

%v = load i8, i8* %x, !invariant.group !0
; if %x mustalias %y then we can replace the above instruction with
%v = load i8, i8* %y

Note that this is an experimental feature, which means that its semantics might
change in the future.

'``type``' Metadata
^^^^^^^^^^^^^^^^^^^

See :doc:`TypeMetadata`.

'``associated``' Metadata
^^^^^^^^^^^^^^^^^^^^^^^^^

The ``associated`` metadata may be attached to a global object
declaration with a single argument that references another global object.

This metadata prevents discarding of the global object in linker GC
unless the referenced object is also discarded. The linker support for
this feature is spotty. For best compatibility, globals carrying this
metadata may also:

- Be in a comdat with the referenced global.
- Be in @llvm.compiler.used.
- Have an explicit section with a name which is a valid C identifier.

It does not have any effect on non-ELF targets.

Example:

.. code-block:: text

$a = comdat any
@a = global i32 1, comdat $a
@b = internal global i32 2, comdat $a, section "abc", !associated !0
!0 = !{i32* @a}

'``prof``' Metadata
^^^^^^^^^^^^^^^^^^^

The ``prof`` metadata is used to record profile data in the IR.
The first operand of the metadata node indicates the profile metadata
type. There are currently 3 types:
:ref:`branch_weights`,
:ref:`function_entry_count`, and
:ref:`VP`.

.. _prof_node_branch_weights:

branch_weights
""""""""""""""

Branch weight metadata attached to a branch, select, switch or call instruction
represents the likeliness of the associated branch being taken.
For more information, see :doc:`BranchWeightMetadata`.

.. _prof_node_function_entry_count:

function_entry_count
""""""""""""""""""""

Function entry count metadata can be attached to function definitions
to record the number of times the function is called. Used with BFI
information, it is also used to derive the basic block profile count.
For more information, see :doc:`BranchWeightMetadata`.

.. _prof_node_VP:

VP
""

VP (value profile) metadata can be attached to instructions that have
value profile information. Currently this is indirect calls (where it
records the hottest callees) and calls to memory intrinsics such as memcpy,
memmove, and memset (where it records the hottest byte lengths).

Each VP metadata node contains "VP" string, then a uint32_t value for the value
profiling kind, a uint64_t value for the total number of times the instruction
is executed, followed by uint64_t value and execution count pairs.
The value profiling kind is 0 for indirect call targets and 1 for memory
operations. For indirect call targets, each profile value is a hash
of the callee function name, and for memory operations each value is the
byte length.

Note that the value counts do not need to add up to the total count
listed in the third operand (in practice only the top hottest values
are tracked and reported).

Indirect call example:

.. code-block:: llvm

call void %f(), !prof !1
!1 = !{!"VP", i32 0, i64 1600, i64 7651369219802541373, i64 1030, i64 -4377547752858689819, i64 410}

Note that the VP type is 0 (the second operand), which indicates this is
an indirect call value profile data. The third operand indicates that the
indirect call executed 1600 times. The 4th and 6th operands give the
hashes of the 2 hottest target functions' names (this is the same hash used
to represent function names in the profile database), and the 5th and 7th
operands give the execution count that each of the respective prior target
functions was called.

Module Flags Metadata
=====================

Information about the module as a whole is difficult to convey to LLVM's
subsystems. The LLVM IR isn't sufficient to transmit this information.
The ``llvm.module.flags`` named metadata exists in order to facilitate
this. These flags are in the form of key / value pairs --- much like a
dictionary --- making it easy for any subsystem who cares about a flag to
look it up.

The ``llvm.module.flags`` metadata contains a list of metadata triplets.
Each triplet has the following form:

- The first element is a *behavior* flag, which specifies the behavior
when two (or more) modules are merged together, and it encounters two
(or more) metadata with the same ID. The supported behaviors are
described below.
- The second element is a metadata string that is a unique ID for the
metadata. Each module may only have one flag entry for each unique ID (not
including entries with the **Require** behavior).
- The third element is the value of the flag.

When two (or more) modules are merged together, the resulting
``llvm.module.flags`` metadata is the union of the modules' flags. That is, for
each unique metadata ID string, there will be exactly one entry in the merged
modules ``llvm.module.flags`` metadata table, and the value for that entry will
be determined by the merge behavior flag, as described below. The only exception
is that entries with the *Require* behavior are always preserved.

The following behaviors are supported:

.. list-table::
:header-rows: 1
:widths: 10 90

* - Value
- Behavior

* - 1
- **Error**
Emits an error if two values disagree, otherwise the resulting value
is that of the operands.

* - 2
- **Warning**
Emits a warning if two values disagree. The result value will be the
operand for the flag from the first module being linked, or the max
if the other module uses **Max** (in which case the resulting flag
will be **Max**).

* - 3
- **Require**
Adds a requirement that another module flag be present and have a
specified value after linking is performed. The value must be a
metadata pair, where the first element of the pair is the ID of the
module flag to be restricted, and the second element of the pair is
the value the module flag should be restricted to. This behavior can
be used to restrict the allowable results (via triggering of an
error) of linking IDs with the **Override** behavior.

* - 4
- **Override**
Uses the specified value, regardless of the behavior or value of the
other module. If both modules specify **Override**, but the values
differ, an error will be emitted.

* - 5
- **Append**
Appends the two values, which are required to be metadata nodes.

* - 6
- **AppendUnique**
Appends the two values, which are required to be metadata
nodes. However, duplicate entries in the second list are dropped
during the append operation.

* - 7
- **Max**
Takes the max of the two values, which are required to be integers.

It is an error for a particular unique flag ID to have multiple behaviors,
except in the case of **Require** (which adds restrictions on another metadata
value) or **Override**.

An example of module flags:

.. code-block:: llvm

!0 = !{ i32 1, !"foo", i32 1 }
!1 = !{ i32 4, !"bar", i32 37 }
!2 = !{ i32 2, !"qux", i32 42 }
!3 = !{ i32 3, !"qux",
!{
!"foo", i32 1
}
}
!llvm.module.flags = !{ !0, !1, !2, !3 }

- Metadata ``!0`` has the ID ``!"foo"`` and the value '1'. The behavior
if two or more ``!"foo"`` flags are seen is to emit an error if their
values are not equal.

- Metadata ``!1`` has the ID ``!"bar"`` and the value '37'. The
behavior if two or more ``!"bar"`` flags are seen is to use the value
'37'.

- Metadata ``!2`` has the ID ``!"qux"`` and the value '42'. The
behavior if two or more ``!"qux"`` flags are seen is to emit a
warning if their values are not equal.

- Metadata ``!3`` has the ID ``!"qux"`` and the value:

::

!{ !"foo", i32 1 }

The behavior is to emit an error if the ``llvm.module.flags`` does not
contain a flag with the ID ``!"foo"`` that has the value '1' after linking is
performed.

Objective-C Garbage Collection Module Flags Metadata
----------------------------------------------------

On the Mach-O platform, Objective-C stores metadata about garbage
collection in a special section called "image info". The metadata
consists of a version number and a bitmask specifying what types of
garbage collection are supported (if any) by the file. If two or more
modules are linked together their garbage collection metadata needs to
be merged rather than appended together.

The Objective-C garbage collection module flags metadata consists of the
following key-value pairs:

.. list-table::
:header-rows: 1
:widths: 30 70

* - Key
- Value

* - ``Objective-C Version``
- **[Required]** --- The Objective-C ABI version. Valid values are 1 and 2.

* - ``Objective-C Image Info Version``
- **[Required]** --- The version of the image info section. Currently
always 0.

* - ``Objective-C Image Info Section``
- **[Required]** --- The section to place the metadata. Valid values are
``"__OBJC, __image_info, regular"`` for Objective-C ABI version 1, and
``"__DATA,__objc_imageinfo, regular, no_dead_strip"`` for
Objective-C ABI version 2.

* - ``Objective-C Garbage Collection``
- **[Required]** --- Specifies whether garbage collection is supported or
not. Valid values are 0, for no garbage collection, and 2, for garbage
collection supported.

* - ``Objective-C GC Only``
- **[Optional]** --- Specifies that only garbage collection is supported.
If present, its value must be 6. This flag requires that the
``Objective-C Garbage Collection`` flag have the value 2.

Some important flag interactions:

- If a module with ``Objective-C Garbage Collection`` set to 0 is
merged with a module with ``Objective-C Garbage Collection`` set to
2, then the resulting module has the
``Objective-C Garbage Collection`` flag set to 0.
- A module with ``Objective-C Garbage Collection`` set to 0 cannot be
merged with a module with ``Objective-C GC Only`` set to 6.

C type width Module Flags Metadata
----------------------------------

The ARM backend emits a section into each generated object file describing the
options that it was compiled with (in a compiler-independent way) to prevent
linking incompatible objects, and to allow automatic library selection. Some
of these options are not visible at the IR level, namely wchar_t width and enum
width.

To pass this information to the backend, these options are encoded in module
flags metadata, using the following key-value pairs:

.. list-table::
:header-rows: 1
:widths: 30 70

* - Key
- Value

* - short_wchar
- * 0 --- sizeof(wchar_t) == 4
* 1 --- sizeof(wchar_t) == 2

* - short_enum
- * 0 --- Enums are at least as large as an ``int``.
* 1 --- Enums are stored in the smallest integer type which can
represent all of its values.

For example, the following metadata section specifies that the module was
compiled with a ``wchar_t`` width of 4 bytes, and the underlying type of an
enum is the smallest type which can represent all of its values::

!llvm.module.flags = !{!0, !1}
!0 = !{i32 1, !"short_wchar", i32 1}
!1 = !{i32 1, !"short_enum", i32 0}

LTO Post-Link Module Flags Metadata
-----------------------------------

Some optimisations are only when the entire LTO unit is present in the current
module. This is represented by the ``LTOPostLink`` module flags metadata, which
will be created with a value of ``1`` when LTO linking occurs.

Automatic Linker Flags Named Metadata
=====================================

Some targets support embedding of flags to the linker inside individual object
files. Typically this is used in conjunction with language extensions which
allow source files to contain linker command line options, and have these
automatically be transmitted to the linker via object files.

These flags are encoded in the IR using named metadata with the name
``!llvm.linker.options``. Each operand is expected to be a metadata node
which should be a list of other metadata nodes, each of which should be a
list of metadata strings defining linker options.

For example, the following metadata section specifies two separate sets of
linker options, presumably to link against ``libz`` and the ``Cocoa``
framework::

!0 = !{ !"-lz" }
!1 = !{ !"-framework", !"Cocoa" }
!llvm.linker.options = !{ !0, !1 }

The metadata encoding as lists of lists of options, as opposed to a collapsed
list of options, is chosen so that the IR encoding can use multiple option
strings to specify e.g., a single library, while still having that specifier be
preserved as an atomic element that can be recognized by a target specific
assembly writer or object file emitter.

Each individual option is required to be either a valid option for the target's
linker, or an option that is reserved by the target specific assembly writer or
object file emitter. No other aspect of these options is defined by the IR.

Dependent Libs Named Metadata
=============================

Some targets support embedding of strings into object files to indicate
a set of libraries to add to the link. Typically this is used in conjunction
with language extensions which allow source files to explicitly declare the
libraries they depend on, and have these automatically be transmitted to the
linker via object files.

The list is encoded in the IR using named metadata with the name
``!llvm.dependent-libraries``. Each operand is expected to be a metadata node
which should contain a single string operand.

For example, the following metadata section contains two library specifiers::

!0 = !{!"a library specifier"}
!1 = !{!"another library specifier"}
!llvm.dependent-libraries = !{ !0, !1 }

Each library specifier will be handled independently by the consuming linker.
The effect of the library specifiers are defined by the consuming linker.

.. _summary:

ThinLTO Summary
===============

Compiling with `ThinLTO `_
causes the building of a compact summary of the module that is emitted into
the bitcode. The summary is emitted into the LLVM assembly and identified
in syntax by a caret ('``^``').

The summary is parsed into a bitcode output, along with the Module
IR, via the "``llvm-as``" tool. Tools that parse the Module IR for the purposes
of optimization (e.g. "``clang -x ir``" and "``opt``"), will ignore the
summary entries (just as they currently ignore summary entries in a bitcode
input file).

Eventually, the summary will be parsed into a ModuleSummaryIndex object under
the same conditions where summary index is currently built from bitcode.
Specifically, tools that test the Thin Link portion of a ThinLTO compile
(i.e. llvm-lto and llvm-lto2), or when parsing a combined index
for a distributed ThinLTO backend via clang's "``-fthinlto-index=<>``" flag
(this part is not yet implemented, use llvm-as to create a bitcode object
before feeding into thin link tools for now).

There are currently 3 types of summary entries in the LLVM assembly:
:ref:`module paths`,
:ref:`global values`, and
:ref:`type identifiers`.

.. _module_path_summary:

Module Path Summary Entry
-------------------------

Each module path summary entry lists a module containing global values included
in the summary. For a single IR module there will be one such entry, but
in a combined summary index produced during the thin link, there will be
one module path entry per linked module with summary.

Example:

.. code-block:: text

^0 = module: (path: "/path/to/file.o", hash: (2468601609, 1329373163, 1565878005, 638838075, 3148790418))

The ``path`` field is a string path to the bitcode file, and the ``hash``
field is the 160-bit SHA-1 hash of the IR bitcode contents, used for
incremental builds and caching.

.. _gv_summary:

Global Value Summary Entry
--------------------------

Each global value summary entry corresponds to a global value defined or
referenced by a summarized module.

Example:

.. code-block:: text

^4 = gv: (name: "f"[, summaries: (Summary)[, (Summary)]*]?) ; guid = 14740650423002898831

For declarations, there will not be a summary list. For definitions, a
global value will contain a list of summaries, one per module containing
a definition. There can be multiple entries in a combined summary index
for symbols with weak linkage.

Each ``Summary`` format will depend on whether the global value is a
:ref:`function`, :ref:`variable`, or
:ref:`alias`.

.. _function_summary:

Function Summary
^^^^^^^^^^^^^^^^

If the global value is a function, the ``Summary`` entry will look like:

.. code-block:: text

function: (module: ^0, flags: (linkage: external, notEligibleToImport: 0, live: 0, dsoLocal: 0), insts: 2[, FuncFlags]?[, Calls]?[, TypeIdInfo]?[, Params]?[, Refs]?

The ``module`` field includes the summary entry id for the module containing
this definition, and the ``flags`` field contains information such as
the linkage type, a flag indicating whether it is legal to import the
definition, whether it is globally live and whether the linker resolved it
to a local definition (the latter two are populated during the thin link).
The ``insts`` field contains the number of IR instructions in the function.
Finally, there are several optional fields: :ref:`FuncFlags`,
:ref:`Calls`, :ref:`TypeIdInfo`,
:ref:`Params`, :ref:`Refs`.

.. _variable_summary:

Global Variable Summary
^^^^^^^^^^^^^^^^^^^^^^^

If the global value is a variable, the ``Summary`` entry will look like:

.. code-block:: text

variable: (module: ^0, flags: (linkage: external, notEligibleToImport: 0, live: 0, dsoLocal: 0)[, Refs]?

The variable entry contains a subset of the fields in a
:ref:`function summary `, see the descriptions there.

.. _alias_summary:

Alias Summary
^^^^^^^^^^^^^

If the global value is an alias, the ``Summary`` entry will look like:

.. code-block:: text

alias: (module: ^0, flags: (linkage: external, notEligibleToImport: 0, live: 0, dsoLocal: 0), aliasee: ^2)

The ``module`` and ``flags`` fields are as described for a
:ref:`function summary `. The ``aliasee`` field
contains a reference to the global value summary entry of the aliasee.

.. _funcflags_summary:

Function Flags
^^^^^^^^^^^^^^

The optional ``FuncFlags`` field looks like:

.. code-block:: text

funcFlags: (readNone: 0, readOnly: 0, noRecurse: 0, returnDoesNotAlias: 0)

If unspecified, flags are assumed to hold the conservative ``false`` value of
``0``.

.. _calls_summary:

Calls
^^^^^

The optional ``Calls`` field looks like:

.. code-block:: text

calls: ((Callee)[, (Callee)]*)

where each ``Callee`` looks like:

.. code-block:: text

callee: ^1[, hotness: None]?[, relbf: 0]?

The ``callee`` refers to the summary entry id of the callee. At most one
of ``hotness`` (which can take the values ``Unknown``, ``Cold``, ``None``,
``Hot``, and ``Critical``), and ``relbf`` (which holds the integer
branch frequency relative to the entry frequency, scaled down by 2^8)
may be specified. The defaults are ``Unknown`` and ``0``, respectively.

.. _params_summary:

Params
^^^^^^

The optional ``Params`` is used by ``StackSafety`` and looks like:

.. code-block:: text

Params: ((Param)[, (Param)]*)

where each ``Param`` describes pointer parameter access inside of the
function and looks like:

.. code-block:: text

param: 4, offset: [0, 5][, calls: ((Callee)[, (Callee)]*)]?

where the first ``param`` is the number of the parameter it describes,
``offset`` is the inclusive range of offsets from the pointer parameter to bytes
which can be accessed by the function. This range does not include accesses by
function calls from ``calls`` list.

where each ``Callee`` decribes how parameter is forwared into other
functions and looks like:

.. code-block:: text

callee: ^3, param: 5, offset: [-3, 3]

The ``callee`` refers to the summary entry id of the callee, ``param`` is
the number of the callee parameter which points into the callers parameter
with offset known to be inside of the ``offset`` range. ``calls`` will be
consumed and removed by thin link stage to update ``Param::offset`` so it
covers all accesses possible by ``calls``.

Pointer parameter without corresponding ``Param`` is considered unsafe and we
assume that access with any offset is possible.

Example:

If we have the following function:

.. code-block:: text

define i64 @foo(i64* %0, i32* %1, i8* %2, i8 %3) {
store i32* %1, i32** @x
%5 = getelementptr inbounds i8, i8* %2, i64 5
%6 = load i8, i8* %5
%7 = getelementptr inbounds i8, i8* %2, i8 %3
tail call void @bar(i8 %3, i8* %7)
%8 = load i64, i64* %0
ret i64 %8
}

We can expect the record like this:

.. code-block:: text

params: ((param: 0, offset: [0, 7]),(param: 2, offset: [5, 5], calls: ((callee: ^3, param: 1, offset: [-128, 127]))))

The function may access just 8 bytes of the paramenter %0 . ``calls`` is empty,
so the parameter is either not used for function calls or ``offset`` already
covers all accesses from nested function calls.
Parameter %1 escapes, so access is unknown.
The function itself can access just a single byte of the parameter %2. Additional
access is possible inside of the ``@bar`` or ``^3``. The function adds signed
offset to the pointer and passes the result as the argument %1 into ``^3``.
This record itself does not tell us how ``^3`` will access the parameter.
Parameter %3 is not a pointer.

.. _refs_summary:

Refs
^^^^

The optional ``Refs`` field looks like:

.. code-block:: text

refs: ((Ref)[, (Ref)]*)

where each ``Ref`` contains a reference to the summary id of the referenced
value (e.g. ``^1``).

.. _typeidinfo_summary:

TypeIdInfo
^^^^^^^^^^

The optional ``TypeIdInfo`` field, used for
`Control Flow Integrity `_,
looks like:

.. code-block:: text

typeIdInfo: [(TypeTests)]?[, (TypeTestAssumeVCalls)]?[, (TypeCheckedLoadVCalls)]?[, (TypeTestAssumeConstVCalls)]?[, (TypeCheckedLoadConstVCalls)]?

These optional fields have the following forms:

TypeTests
"""""""""

.. code-block:: text

typeTests: (TypeIdRef[, TypeIdRef]*)

Where each ``TypeIdRef`` refers to a :ref:`type id`
by summary id or ``GUID``.

TypeTestAssumeVCalls
""""""""""""""""""""

.. code-block:: text

typeTestAssumeVCalls: (VFuncId[, VFuncId]*)

Where each VFuncId has the format:

.. code-block:: text

vFuncId: (TypeIdRef, offset: 16)

Where each ``TypeIdRef`` refers to a :ref:`type id`
by summary id or ``GUID`` preceded by a ``guid:`` tag.

TypeCheckedLoadVCalls
"""""""""""""""""""""

.. code-block:: text

typeCheckedLoadVCalls: (VFuncId[, VFuncId]*)

Where each VFuncId has the format described for ``TypeTestAssumeVCalls``.

TypeTestAssumeConstVCalls
"""""""""""""""""""""""""

.. code-block:: text

typeTestAssumeConstVCalls: (ConstVCall[, ConstVCall]*)

Where each ConstVCall has the format:

.. code-block:: text

(VFuncId, args: (Arg[, Arg]*))

and where each VFuncId has the format described for ``TypeTestAssumeVCalls``,
and each Arg is an integer argument number.

TypeCheckedLoadConstVCalls
""""""""""""""""""""""""""

.. code-block:: text

typeCheckedLoadConstVCalls: (ConstVCall[, ConstVCall]*)

Where each ConstVCall has the format described for
``TypeTestAssumeConstVCalls``.

.. _typeid_summary:

Type ID Summary Entry
---------------------

Each type id summary entry corresponds to a type identifier resolution
which is generated during the LTO link portion of the compile when building
with `Control Flow Integrity `_,
so these are only present in a combined summary index.

Example:

.. code-block:: text

^4 = typeid: (name: "_ZTS1A", summary: (typeTestRes: (kind: allOnes, sizeM1BitWidth: 7[, alignLog2: 0]?[, sizeM1: 0]?[, bitMask: 0]?[, inlineBits: 0]?)[, WpdResolutions]?)) ; guid = 7004155349499253778

The ``typeTestRes`` gives the type test resolution ``kind`` (which may
be ``unsat``, ``byteArray``, ``inline``, ``single``, or ``allOnes``), and
the ``size-1`` bit width. It is followed by optional flags, which default to 0,
and an optional WpdResolutions (whole program devirtualization resolution)
field that looks like:

.. code-block:: text

wpdResolutions: ((offset: 0, WpdRes)[, (offset: 1, WpdRes)]*

where each entry is a mapping from the given byte offset to the whole-program
devirtualization resolution WpdRes, that has one of the following formats:

.. code-block:: text

wpdRes: (kind: branchFunnel)
wpdRes: (kind: singleImpl, singleImplName: "_ZN1A1nEi")
wpdRes: (kind: indir)

Additionally, each wpdRes has an optional ``resByArg`` field, which
describes the resolutions for calls with all constant integer arguments:

.. code-block:: text

resByArg: (ResByArg[, ResByArg]*)

where ResByArg is:

.. code-block:: text

args: (Arg[, Arg]*), byArg: (kind: UniformRetVal[, info: 0][, byte: 0][, bit: 0])

Where the ``kind`` can be ``Indir``, ``UniformRetVal``, ``UniqueRetVal``
or ``VirtualConstProp``. The ``info`` field is only used if the kind
is ``UniformRetVal`` (indicates the uniform return value), or
``UniqueRetVal`` (holds the return value associated with the unique vtable
(0 or 1)). The ``byte`` and ``bit`` fields are only used if the target does
not support the use of absolute symbols to store constants.

.. _intrinsicglobalvariables:

Intrinsic Global Variables
==========================

LLVM has a number of "magic" global variables that contain data that
affect code generation or other IR semantics. These are documented here.
All globals of this sort should have a section specified as
"``llvm.metadata``". This section and all globals that start with
"``llvm.``" are reserved for use by LLVM.

.. _gv_llvmused:

The '``llvm.used``' Global Variable
-----------------------------------

The ``@llvm.used`` global is an array which has
:ref:`appending linkage `. This array contains a list of
pointers to named global variables, functions and aliases which may optionally
have a pointer cast formed of bitcast or getelementptr. For example, a legal
use of it is:

.. code-block:: llvm

@X = global i8 4
@Y = global i32 123

@llvm.used = appending global [2 x i8*] [
i8* @X,
i8* bitcast (i32* @Y to i8*)
], section "llvm.metadata"

If a symbol appears in the ``@llvm.used`` list, then the compiler, assembler,
and linker are required to treat the symbol as if there is a reference to the
symbol that it cannot see (which is why they have to be named). For example, if
a variable has internal linkage and no references other than that from the
``@llvm.used`` list, it cannot be deleted. This is commonly used to represent
references from inline asms and other things the compiler cannot "see", and
corresponds to "``attribute((used))``" in GNU C.

On some targets, the code generator must emit a directive to the
assembler or object file to prevent the assembler and linker from
removing the symbol.

.. _gv_llvmcompilerused:

The '``llvm.compiler.used``' Global Variable
--------------------------------------------

The ``@llvm.compiler.used`` directive is the same as the ``@llvm.used``
directive, except that it only prevents the compiler from touching the
symbol. On targets that support it, this allows an intelligent linker to
optimize references to the symbol without being impeded as it would be
by ``@llvm.used``.

This is a rare construct that should only be used in rare circumstances,
and should not be exposed to source languages.

.. _gv_llvmglobalctors:

The '``llvm.global_ctors``' Global Variable
-------------------------------------------

.. code-block:: llvm

%0 = type { i32, void ()*, i8* }
@llvm.global_ctors = appending global [1 x %0] [%0 { i32 65535, void ()* @ctor, i8* @data }]

The ``@llvm.global_ctors`` array contains a list of constructor
functions, priorities, and an associated global or function.
The functions referenced by this array will be called in ascending order
of priority (i.e. lowest first) when the module is loaded. The order of
functions with the same priority is not defined.

If the third field is non-null, and points to a global variable
or function, the initializer function will only run if the associated
data from the current module is not discarded.

.. _llvmglobaldtors:

The '``llvm.global_dtors``' Global Variable
-------------------------------------------

.. code-block:: llvm

%0 = type { i32, void ()*, i8* }
@llvm.global_dtors = appending global [1 x %0] [%0 { i32 65535, void ()* @dtor, i8* @data }]

The ``@llvm.global_dtors`` array contains a list of destructor
functions, priorities, and an associated global or function.
The functions referenced by this array will be called in descending
order of priority (i.e. highest first) when the module is unloaded. The
order of functions with the same priority is not defined.

If the third field is non-null, and points to a global variable
or function, the destructor function will only run if the associated
data from the current module is not discarded.

Instruction Reference
=====================

The LLVM instruction set consists of several different classifications
of instructions: :ref:`terminator instructions `, :ref:`binary
instructions `, :ref:`bitwise binary
instructions `, :ref:`memory instructions `, and
:ref:`other instructions `.

.. _terminators:

Terminator Instructions
-----------------------

As mentioned :ref:`previously `, every basic block in a
program ends with a "Terminator" instruction, which indicates which
block should be executed after the current block is finished. These
terminator instructions typically yield a '``void``' value: they produce
control flow, not values (the one exception being the
':ref:`invoke `' instruction).

The terminator instructions are: ':ref:`ret `',
':ref:`br `', ':ref:`switch `',
':ref:`indirectbr `', ':ref:`invoke `',
':ref:`callbr `'
':ref:`resume `', ':ref:`catchswitch `',
':ref:`catchret `',
':ref:`cleanupret `',
and ':ref:`unreachable `'.

.. _i_ret:

'``ret``' Instruction
^^^^^^^^^^^^^^^^^^^^^

Syntax:
"""""""

::

ret ; Return a value from a non-void function
ret void ; Return from void function

Overview:
"""""""""

The '``ret``' instruction is used to return control flow (and optionally
a value) from a function back to the caller.

There are two forms of the '``ret``' instruction: one that returns a
value and then causes control flow, and one that just causes control
flow to occur.

Arguments:
""""""""""

The '``ret``' instruction optionally accepts a single argument, the
return value. The type of the return value must be a ':ref:`first
class `' type.

A function is not :ref:`well formed ` if it has a non-void
return type and contains a '``ret``' instruction with no return value or
a return value with a type that does not match its type, or if it has a
void return type and contains a '``ret``' instruction with a return
value.

Semantics:
""""""""""

When the '``ret``' instruction is executed, control flow returns back to
the calling function's context. If the caller is a
":ref:`call `" instruction, execution continues at the
instruction after the call. If the caller was an
":ref:`invoke `" instruction, execution continues at the
beginning of the "normal" destination block. If the instruction returns
a value, that value shall set the call or invoke instruction's return
value.

Example:
""""""""

.. code-block:: llvm

ret i32 5 ; Return an integer value of 5
ret void ; Return from a void function
ret { i32, i8 } { i32 4, i8 2 } ; Return a struct of values 4 and 2

.. _i_br:

'``br``' Instruction
^^^^^^^^^^^^^^^^^^^^

Syntax:
"""""""

::

br i1 , label , label
br label ; Unconditional branch

Overview:
"""""""""

The '``br``' instruction is used to cause control flow to transfer to a
different basic block in the current function. There are two forms of
this instruction, corresponding to a conditional branch and an
unconditional branch.

Arguments:
""""""""""

The conditional branch form of the '``br``' instruction takes a single
'``i1``' value and two '``label``' values. The unconditional form of the
'``br``' instruction takes a single '``label``' value as a target.

Semantics:
""""""""""

Upon execution of a conditional '``br``' instruction, the '``i1``'
argument is evaluated. If the value is ``true``, control flows to the
'``iftrue``' ``label`` argument. If "cond" is ``false``, control flows
to the '``iffalse``' ``label`` argument.
If '``cond``' is ``poison`` or ``undef``, this instruction has undefined
behavior.

Example:
""""""""

.. code-block:: llvm

Test:
%cond = icmp eq i32 %a, %b
br i1 %cond, label %IfEqual, label %IfUnequal
IfEqual:
ret i32 1
IfUnequal:
ret i32 0

.. _i_switch:

'``switch``' Instruction
^^^^^^^^^^^^^^^^^^^^^^^^

Syntax:
"""""""

::

switch , label [ , label ... ]

Overview:
"""""""""

The '``switch``' instruction is used to transfer control flow to one of
several different places. It is a generalization of the '``br``'
instruction, allowing a branch to occur to one of many possible
destinations.

Arguments:
""""""""""

The '``switch``' instruction uses three parameters: an integer
comparison value '``value``', a default '``label``' destination, and an
array of pairs of comparison value constants and '``label``'s. The table
is not allowed to contain duplicate constant entries.

Semantics:
""""""""""

The ``switch`` instruction specifies a table of values and destinations.
When the '``switch``' instruction is executed, this table is searched
for the given value. If the value is found, control flow is transferred
to the corresponding destination; otherwise, control flow is transferred
to the default destination.
If '``value``' is ``poison`` or ``undef``, this instruction has undefined
behavior.

Implementation:
"""""""""""""""

Depending on properties of the target machine and the particular
``switch`` instruction, this instruction may be code generated in
different ways. For example, it could be generated as a series of
chained conditional branches or with a lookup table.

Example:
""""""""

.. code-block:: llvm

; Emulate a conditional br instruction
%Val = zext i1 %value to i32
switch i32 %Val, label %truedest [ i32 0, label %falsedest ]

; Emulate an unconditional br instruction
switch i32 0, label %dest [ ]

; Implement a jump table:
switch i32 %val, label %otherwise [ i32 0, label %onzero
i32 1, label %onone
i32 2, label %ontwo ]

.. _i_indirectbr:

'``indirectbr``' Instruction
^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Syntax:
"""""""

::

indirectbr *