1 ========================================
2 Machine IR (MIR) Format Reference Manual
3 ========================================
9 This is a work in progress.
14 This document is a reference manual for the Machine IR (MIR) serialization
15 format. MIR is a human readable serialization format that is used to represent
16 LLVM's :ref:`machine specific intermediate representation
17 <machine code representation>`.
19 The MIR serialization format is designed to be used for testing the code
20 generation passes in LLVM.
25 The MIR serialization format uses a YAML container. YAML is a standard
26 data serialization language, and the full YAML language spec can be read at
28 <http://www.yaml.org/spec/1.2/spec.html#Introduction>`_.
30 A MIR file is split up into a series of `YAML documents`_. The first document
31 can contain an optional embedded LLVM IR module, and the rest of the documents
32 contain the serialized machine functions.
34 .. _YAML documents: http://www.yaml.org/spec/1.2/spec.html#id2800132
39 You can use the MIR format for testing in two different ways:
41 - You can write MIR tests that invoke a single code generation pass using the
42 ``-run-pass`` option in llc.
44 - You can use llc's ``-stop-after`` option with existing or new LLVM assembly
45 tests and check the MIR output of a specific code generation pass.
47 Testing Individual Code Generation Passes
48 -----------------------------------------
50 The ``-run-pass`` option in llc allows you to create MIR tests that invoke just
51 a single code generation pass. When this option is used, llc will parse an
52 input MIR file, run the specified code generation pass(es), and output the
55 You can generate an input MIR file for the test by using the ``-stop-after`` or
56 ``-stop-before`` option in llc. For example, if you would like to write a test
57 for the post register allocation pseudo instruction expansion pass, you can
58 specify the machine copy propagation pass in the ``-stop-after`` option, as it
59 runs just before the pass that we are trying to test:
61 ``llc -stop-after=machine-cp bug-trigger.ll > test.mir``
63 If the same pass is run multiple times, a run index can be included
64 after the name with a comma.
66 ``llc -stop-after=dead-mi-elimination,1 bug-trigger.ll > test.mir``
68 After generating the input MIR file, you'll have to add a run line that uses
69 the ``-run-pass`` option to it. In order to test the post register allocation
70 pseudo instruction expansion pass on X86-64, a run line like the one shown
73 ``# RUN: llc -o - %s -mtriple=x86_64-- -run-pass=postrapseudos | FileCheck %s``
75 The MIR files are target dependent, so they have to be placed in the target
76 specific test directories (``lib/CodeGen/TARGETNAME``). They also need to
77 specify a target triple or a target architecture either in the run line or in
78 the embedded LLVM IR module.
83 The MIR code coming out of ``-stop-after``/``-stop-before`` is very verbose;
84 Tests are more accessible and future proof when simplified:
86 - Use the ``-simplify-mir`` option with llc.
88 - Machine function attributes often have default values or the test works just
89 as well with default values. Typical candidates for this are: `alignment:`,
90 `exposesReturnsTwice`, `legalized`, `regBankSelected`, `selected`.
91 The whole `frameInfo` section is often unnecessary if there is no special
92 frame usage in the function. `tracksRegLiveness` on the other hand is often
93 necessary for some passes that care about block livein lists.
95 - The (global) `liveins:` list is typically only interesting for early
96 instruction selection passes and can be removed when testing later passes.
97 The per-block `liveins:` on the other hand are necessary if
98 `tracksRegLiveness` is true.
100 - Branch probability data in block `successors:` lists can be dropped if the
101 test doesn't depend on it. Example:
102 `successors: %bb.1(0x40000000), %bb.2(0x40000000)` can be replaced with
103 `successors: %bb.1, %bb.2`.
105 - MIR code contains a whole IR module. This is necessary because there are
106 no equivalents in MIR for global variables, references to external functions,
107 function attributes, metadata, debug info. Instead some MIR data references
108 the IR constructs. You can often remove them if the test doesn't depend on
111 - Alias Analysis is performed on IR values. These are referenced by memory
112 operands in MIR. Example: `:: (load 8 from %ir.foobar, !alias.scope !9)`.
113 If the test doesn't depend on (good) alias analysis the references can be
114 dropped: `:: (load 8)`
116 - MIR blocks can reference IR blocks for debug printing, profile information
117 or debug locations. Example: `bb.42.myblock` in MIR references the IR block
118 `myblock`. It is usually possible to drop the `.myblock` reference and simply
121 - If there are no memory operands or blocks referencing the IR then the
122 IR function can be replaced by a parameterless dummy function like
123 `define @func() { ret void }`.
125 - It is possible to drop the whole IR section of the MIR file if it only
126 contains dummy functions (see above). The .mir loader will create the
127 IR functions automatically in this case.
134 Currently the MIR format has several limitations in terms of which state it
137 - The target-specific state in the target-specific ``MachineFunctionInfo``
138 subclasses isn't serialized at the moment.
140 - The target-specific ``MachineConstantPoolValue`` subclasses (in the ARM and
141 SystemZ backends) aren't serialized at the moment.
143 - The ``MCSymbol`` machine operands don't support temporary or local symbols.
145 - A lot of the state in ``MachineModuleInfo`` isn't serialized - only the CFI
146 instructions and the variable debug information from MMI is serialized right
149 These limitations impose restrictions on what you can test with the MIR format.
150 For now, tests that would like to test some behaviour that depends on the state
151 of temporary or local ``MCSymbol`` operands or the exception handling state in
152 MMI, can't use the MIR format. As well as that, tests that test some behaviour
153 that depends on the state of the target specific ``MachineFunctionInfo`` or
154 ``MachineConstantPoolValue`` subclasses can't use the MIR format at the moment.
164 When the first YAML document contains a `YAML block literal string`_, the MIR
165 parser will treat this string as an LLVM assembly language string that
166 represents an embedded LLVM IR module.
167 Here is an example of a YAML document that contains an LLVM module:
171 define i32 @inc(i32* %x) {
173 %0 = load i32, i32* %x
175 store i32 %1, i32* %x
179 .. _YAML block literal string: http://www.yaml.org/spec/1.2/spec.html#id2795688
184 The remaining YAML documents contain the machine functions. This is an example
185 of such YAML document:
191 tracksRegLiveness: true
195 - { bb: 0, offset: 3, fwdArgRegs:
196 - { arg: 0, reg: '$edi' } }
201 $eax = MOV32rm $rdi, 1, _, 0, _
202 $eax = INC32r killed $eax, implicit-def dead $eflags
203 MOV32mr killed $rdi, 1, _, 0, _, $eax
204 CALL64pcrel32 @foo <regmask...>
208 The document above consists of attributes that represent the various
209 properties and data structures in a machine function.
211 The attribute ``name`` is required, and its value should be identical to the
212 name of a function that this machine function is based on.
214 The attribute ``body`` is a `YAML block literal string`_. Its value represents
215 the function's machine basic blocks and their machine instructions.
217 The attribute ``callSites`` is a representation of call site information which
218 keeps track of call instructions and registers used to transfer call arguments.
220 Machine Instructions Format Reference
221 =====================================
223 The machine basic blocks and their instructions are represented using a custom,
224 human readable serialization language. This language is used in the
225 `YAML block literal string`_ that corresponds to the machine function's body.
227 A source string that uses this language contains a list of machine basic
228 blocks, which are described in the section below.
233 A machine basic block is defined in a single block definition source construct
234 that contains the block's ID.
235 The example below defines two blocks that have an ID of zero and one:
244 A machine basic block can also have a name. It should be specified after the ID
245 in the block's definition:
249 bb.0.entry: ; This block's name is "entry"
252 The block's name should be identical to the name of the IR block that this
253 machine block is based on.
255 .. _block-references:
260 The machine basic blocks are identified by their ID numbers. Individual
261 blocks are referenced using the following syntax:
273 The following syntax is also supported, but the former syntax is preferred for
289 The machine basic block's successors have to be specified before any of the
295 successors: %bb.1.then, %bb.2.else
302 The branch weights can be specified in brackets after the successor blocks.
303 The example below defines a block that has two successors with branch weights
309 successors: %bb.1.then(32), %bb.2.else(16)
316 The machine basic block's live in registers have to be specified before any of
324 The list of live in registers and successors can be empty. The language also
325 allows multiple live in register and successor lists - they are combined into
326 one list by the parser.
328 Miscellaneous Attributes
329 ^^^^^^^^^^^^^^^^^^^^^^^^
331 The attributes ``IsAddressTaken``, ``IsLandingPad``,
332 ``IsInlineAsmBrIndirectTarget`` and ``Alignment`` can be specified in brackets
333 after the block's definition:
337 bb.0.entry (address-taken):
341 bb.3(landing-pad, align 4):
343 bb.4 (inlineasm-br-indirect-target):
346 .. TODO: Describe the way the reference to an unnamed LLVM IR block can be
349 ``Alignment`` is specified in bytes, and must be a power of two.
351 .. _mir-instructions:
356 A machine instruction is composed of a name,
357 :ref:`machine operands <machine-operands>`,
358 :ref:`instruction flags <instruction-flags>`, and machine memory operands.
360 The instruction's name is usually specified before the operands. The example
361 below shows an instance of the X86 ``RETQ`` instruction with a single machine
368 However, if the machine instruction has one or more explicitly defined register
369 operands, the instruction's name has to be specified after them. The example
370 below shows an instance of the AArch64 ``LDPXpost`` instruction with three
371 defined register operands:
375 $sp, $fp, $lr = LDPXpost $sp, 2
377 The instruction names are serialized using the exact definitions from the
378 target's ``*InstrInfo.td`` files, and they are case sensitive. This means that
379 similar instruction names like ``TSTri`` and ``tSTRi`` represent different
380 machine instructions.
382 .. _instruction-flags:
387 The flag ``frame-setup`` or ``frame-destroy`` can be specified before the
392 $fp = frame-setup ADDXri $sp, 0, 0
396 $x21, $x20 = frame-destroy LDPXi $sp
403 The syntax for bundled instructions is the following:
407 BUNDLE implicit-def $r0, implicit-def $r1, implicit $r2 {
409 $r1 = ANOTHER_OP internal $r0
412 The first instruction is often a bundle header. The instructions between ``{``
413 and ``}`` are bundled with the first instruction.
420 Registers are one of the key primitives in the machine instructions
421 serialization language. They are primarily used in the
422 :ref:`register machine operands <register-operands>`,
423 but they can also be used in a number of other places, like the
424 :ref:`basic block's live in list <bb-liveins>`.
426 The physical registers are identified by their name and by the '$' prefix sigil.
427 They use the following syntax:
433 The example below shows three X86 physical registers:
441 The virtual registers are identified by their ID number and by the '%' sigil.
442 They use the following syntax:
454 The null registers are represented using an underscore ('``_``'). They can also be
455 represented using a '``$noreg``' named register, although the former syntax
458 .. _machine-operands:
463 There are eighteen different kinds of machine operands, and all of them can be
469 The immediate machine operands are untyped, 64-bit signed integers. The
470 example below shows an instance of the X86 ``MOV32ri`` instruction that has an
471 immediate machine operand ``-42``:
477 An immediate operand is also used to represent a subregister index when the
478 machine instruction has one of the following opcodes:
488 In case this is true, the Machine Operand is printed according to the target.
492 In AArch64RegisterInfo.td:
496 def sub_32 : SubRegIndex<32>;
498 If the third operand is an immediate with the value ``15`` (target-dependent
499 value), based on the instruction's opcode and the operand's index the operand
500 will be printed as ``%subreg.sub_32``:
504 %1:gpr64 = SUBREG_TO_REG 0, %0, %subreg.sub_32
506 For integers > 64bit, we use a special machine operand, ``MO_CImmediate``,
507 which stores the immediate in a ``ConstantInt`` using an ``APInt`` (LLVM's
508 arbitrary precision integers).
510 .. TODO: Describe the FPIMM immediate operands.
512 .. _register-operands:
517 The :ref:`register <registers>` primitive is used to represent the register
518 machine operands. The register operands can also have optional
519 :ref:`register flags <register-flags>`,
520 :ref:`a subregister index <subregister-indices>`,
521 and a reference to the tied register operand.
522 The full syntax of a register operand is shown below:
526 [<flags>] <register> [ :<subregister-idx-name> ] [ (tied-def <tied-op>) ]
528 This example shows an instance of the X86 ``XOR32rr`` instruction that has
529 5 register operands with different register flags:
533 dead $eax = XOR32rr undef $eax, undef $eax, implicit-def dead $eflags, implicit-def $al
540 The table below shows all of the possible register flags along with the
541 corresponding internal ``llvm::RegState`` representation:
550 - ``RegState::Implicit``
553 - ``RegState::ImplicitDefine``
556 - ``RegState::Define``
565 - ``RegState::Undef``
568 - ``RegState::InternalRead``
570 * - ``early-clobber``
571 - ``RegState::EarlyClobber``
574 - ``RegState::Debug``
577 - ``RegState::Renamable``
579 .. _subregister-indices:
584 The register machine operands can reference a portion of a register by using
585 the subregister indices. The example below shows an instance of the ``COPY``
586 pseudo instruction that uses the X86 ``sub_8bit`` subregister index to copy 8
587 lower bits from the 32-bit virtual register 0 to the 8-bit virtual register 1:
591 %1 = COPY %0:sub_8bit
593 The names of the subregister indices are target specific, and are typically
594 defined in the target's ``*RegisterInfo.td`` file.
596 Constant Pool Indices
597 ^^^^^^^^^^^^^^^^^^^^^
599 A constant pool index (CPI) operand is printed using its index in the
600 function's ``MachineConstantPool`` and an offset.
602 For example, a CPI with the index 1 and offset 8:
606 %1:gr64 = MOV64ri %const.1 + 8
608 For a CPI with the index 0 and offset -12:
612 %1:gr64 = MOV64ri %const.0 - 12
614 A constant pool entry is bound to a LLVM IR ``Constant`` or a target-specific
615 ``MachineConstantPoolValue``. When serializing all the function's constants the
616 following format is used:
623 alignment: <alignment>
624 isTargetSpecific: <target-specific>
627 - ``<index>`` is a 32-bit unsigned integer;
628 - ``<value>`` is a `LLVM IR Constant
629 <https://www.llvm.org/docs/LangRef.html#constants>`_;
630 - ``<alignment>`` is a 32-bit unsigned integer specified in bytes, and must be
632 - ``<target-specific>`` is either true or false.
640 value: 'double 3.250000e+00'
645 isTargetSpecific: true
647 Global Value Operands
648 ^^^^^^^^^^^^^^^^^^^^^
650 The global value machine operands reference the global values from the
651 :ref:`embedded LLVM IR module <embedded-module>`.
652 The example below shows an instance of the X86 ``MOV64rm`` instruction that has
653 a global value operand named ``G``:
657 $rax = MOV64rm $rip, 1, _, @G, _
659 The named global values are represented using an identifier with the '@' prefix.
660 If the identifier doesn't match the regular expression
661 `[-a-zA-Z$._][-a-zA-Z$._0-9]*`, then this identifier must be quoted.
663 The unnamed global values are represented using an unsigned numeric value with
664 the '@' prefix, like in the following examples: ``@0``, ``@989``.
666 Target-dependent Index Operands
667 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
669 A target index operand is a target-specific index and an offset. The
670 target-specific index is printed using target-specific names and a positive or
673 For example, the ``amdgpu-constdata-start`` is associated with the index ``0``
674 in the AMDGPU backend. So if we have a target index operand with the index 0
679 $sgpr2 = S_ADD_U32 _, target-index(amdgpu-constdata-start) + 8, implicit-def _, implicit-def _
681 Jump-table Index Operands
682 ^^^^^^^^^^^^^^^^^^^^^^^^^
684 A jump-table index operand with the index 0 is printed as following:
688 tBR_JTr killed $r0, %jump-table.0
690 A machine jump-table entry contains a list of ``MachineBasicBlocks``. When serializing all the function's jump-table entries, the following format is used:
698 blocks: [ <bbreference>, <bbreference>, ... ]
700 where ``<kind>`` is describing how the jump table is represented and emitted (plain address, relocations, PIC, etc.), and each ``<index>`` is a 32-bit unsigned integer and ``blocks`` contains a list of :ref:`machine basic block references <block-references>`.
710 blocks: [ '%bb.3', '%bb.9', '%bb.4.d3' ]
712 blocks: [ '%bb.7', '%bb.7', '%bb.4.d3', '%bb.5' ]
714 External Symbol Operands
715 ^^^^^^^^^^^^^^^^^^^^^^^^^
717 An external symbol operand is represented using an identifier with the ``&``
718 prefix. The identifier is surrounded with ""'s and escaped if it has any
719 special non-printable characters in it.
725 CALL64pcrel32 &__stack_chk_fail, csr_64, implicit $rsp, implicit-def $rsp
730 A MCSymbol operand is holding a pointer to a ``MCSymbol``. For the limitations
731 of this operand in MIR, see :ref:`limitations <limitations>`.
737 EH_LABEL <mcsymbol Ltmp1>
739 Debug Instruction Reference Operands
740 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
742 A debug instruction reference operand is a pair of indices, referring to an
743 instruction and an operand within that instruction respectively; see
744 :ref:`Instruction referencing locations <instruction-referencing-locations>`.
746 The example below uses a reference to Instruction 1, Operand 0:
750 DBG_INSTR_REF !123, !DIExpression(DW_OP_LLVM_arg, 0), dbg-instr-ref(1, 0), debug-location !456
755 A CFI Index operand is holding an index into a per-function side-table,
756 ``MachineFunction::getFrameInstructions()``, which references all the frame
757 instructions in a ``MachineFunction``. A ``CFI_INSTRUCTION`` may look like it
758 contains multiple operands, but the only operand it contains is the CFI Index.
759 The other operands are tracked by the ``MCCFIInstruction`` object.
765 CFI_INSTRUCTION offset $w30, -16
767 which may be emitted later in the MC layer as:
776 An Intrinsic ID operand contains a generic intrinsic ID or a target-specific ID.
778 The syntax for the ``returnaddress`` intrinsic is:
782 $x0 = COPY intrinsic(@llvm.returnaddress)
787 A Predicate operand contains an IR predicate from ``CmpInst::Predicate``, like
790 For an int eq predicate ``ICMP_EQ``, the syntax is:
794 %2:gpr(s32) = G_ICMP intpred(eq), %0, %1
796 .. TODO: Describe the parsers default behaviour when optional YAML attributes
798 .. TODO: Describe the syntax for virtual register YAML definitions.
799 .. TODO: Describe the machine function's YAML flag attributes.
800 .. TODO: Describe the syntax for the register mask machine operands.
801 .. TODO: Describe the frame information YAML mapping.
802 .. TODO: Describe the syntax of the stack object machine operands and their
804 .. TODO: Describe the syntax of the block address machine operands.
805 .. TODO: Describe the syntax of the metadata machine operands, and the
806 instructions debug location attribute.
807 .. TODO: Describe the syntax of the register live out machine operands.
808 .. TODO: Describe the syntax of the machine memory operands.
813 Machine operands can have C/C++ style comments, which are annotations enclosed
814 between ``/*`` and ``*/`` to improve readability of e.g. immediate operands.
815 In the example below, ARM instructions EOR and BCC and immediate operands
816 ``14`` and ``0`` have been annotated with their condition codes (CC)
817 definitions, i.e. the ``always`` and ``eq`` condition codes:
821 dead renamable $r2, $cpsr = tEOR killed renamable $r2, renamable $r1, 14 /* CC::always */, $noreg
822 t2Bcc %bb.4, 0 /* CC:eq */, killed $cpsr
824 As these annotations are comments, they are ignored by the MI parser.
825 Comments can be added or customized by overriding InstrInfo's hook
826 ``createMIROperandComment()``.
828 Debug-Info constructs
829 ---------------------
831 Most of the debugging information in a MIR file is to be found in the metadata
832 of the embedded module. Within a machine function, that metadata is referred to
833 by various constructs to describe source locations and variable locations.
838 Every MIR instruction may optionally have a trailing reference to a
839 ``DILocation`` metadata node, after all operands and symbols, but before
844 $rbp = MOV64rr $rdi, debug-location !12
846 The source location attachment is synonymous with the ``!dbg`` metadata
847 attachment in LLVM-IR. The absence of a source location attachment will be
848 represented by an empty ``DebugLoc`` object in the machine instruction.
850 Fixed variable locations
851 ^^^^^^^^^^^^^^^^^^^^^^^^
853 There are several ways of specifying variable locations. The simplest is
854 describing a variable that is permanently located on the stack. In the stack
855 or fixedStack attribute of the machine function, the variable, scope, and
856 any qualifying location modifier are provided:
860 - { id: 0, name: offset.addr, offset: -24, size: 8, alignment: 8, stack-id: default,
861 4 debug-info-variable: '!1', debug-info-expression: '!DIExpression()',
862 debug-info-location: '!2' }
866 - ``debug-info-variable`` identifies a DILocalVariable metadata node,
868 - ``debug-info-expression`` adds qualifiers to the variable location,
870 - ``debug-info-location`` identifies a DILocation metadata node.
872 These metadata attributes correspond to the operands of a ``llvm.dbg.declare``
873 IR intrinsic, see the :ref:`source level debugging<format_common_intrinsics>`
876 Varying variable locations
877 ^^^^^^^^^^^^^^^^^^^^^^^^^^
879 Variables that are not always on the stack or change location are specified
880 with the ``DBG_VALUE`` meta machine instruction. It is synonymous with the
881 ``llvm.dbg.value`` IR intrinsic, and is written:
885 DBG_VALUE $rax, $noreg, !123, !DIExpression(), debug-location !456
887 The operands to which respectively:
889 1. Identifies a machine location such as a register, immediate, or frame index,
891 2. Is either $noreg, or immediate value zero if an extra level of indirection is to be added to the first operand,
893 3. Identifies a ``DILocalVariable`` metadata node,
895 4. Specifies an expression qualifying the variable location, either inline or as a metadata node reference,
897 While the source location identifies the ``DILocation`` for the scope of the
898 variable. The second operand (``IsIndirect``) is deprecated and to be deleted.
899 All additional qualifiers for the variable location should be made through the
902 .. _instruction-referencing-locations:
904 Instruction referencing locations
905 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
907 This experimental feature aims to separate the specification of variable
908 *values* from the program point where a variable takes on that value. Changes
909 in variable value occur in the same manner as ``DBG_VALUE`` meta instructions
910 but using ``DBG_INSTR_REF``. Variable values are identified by a pair of
911 instruction number and operand number. Consider the example below:
915 $rbp = MOV64ri 0, debug-instr-number 1, debug-location !12
916 DBG_INSTR_REF !123, !DIExpression(DW_OP_LLVM_arg, 0), dbg-instr-ref(1, 0), debug-location !456
918 Instruction numbers are directly attached to machine instructions with an
919 optional ``debug-instr-number`` attachment, before the optional
920 ``debug-location`` attachment. The value defined in ``$rbp`` in the code
921 above would be identified by the pair ``<1, 0>``.
923 The 3rd operand of the ``DBG_INSTR_REF`` above records the instruction
924 and operand number ``<1, 0>``, identifying the value defined by the ``MOV64ri``.
925 The first two operands to ``DBG_INSTR_REF`` are identical to ``DBG_VALUE_LIST``,
926 and the ``DBG_INSTR_REF`` s position records where the variable takes on the
927 designated value in the same way.
929 More information about how these constructs are used is available in
930 :doc:`InstrRefDebugInfo`. The related documents :doc:`SourceLevelDebugging` and
931 :doc:`HowToUpdateDebugInfo` may be useful as well.