LLVM Bytecode File Format

1. Abstract
2. Concepts
   1. Blocks
   2. Lists
   3. Fields
   4. Alignment
   5. Variable Bit-Rate Encoding
   6. Encoding Primitives
   7. Slots
3. General Structure
4. Block Definitions
   1. Signature Block
   2. Module Block
   3. Global Type Pool
   4. Module Info Block
   5. Global Constant Pool
   6. Function Definition
   7. Instructions List
   8. Instructions
   9. Symbol Table
5. Version Differences
   1. Version 1.3 Differences From 1.4
   2. Version 1.2 Differences From 1.3
   3. Version 1.1 Differences From 1.2
   4. Version 1.0 Differences From 1.1

Written by Reid Spencer

Abstract

This document describes the LLVM bytecode file format. It specifies the binary encoding rules of the bytecode file format so that equivalent systems can encode bytecode files correctly. The LLVM bytecode representation is used to store the intermediate representation on disk in compacted form.

The LLVM bytecode format may change in the future, but LLVM will always be backwards compatible with older formats. This document will only describe the most current version of the bytecode format. See Version Differences for the details on how the current version is different from previous versions.

Concepts

This section describes the general concepts of the bytecode file format without getting into specific layout details. It is recommended that you read this section thoroughly before interpreting the detailed descriptions.

Blocks

LLVM bytecode files consist simply of a sequence of blocks of bytes using a binary encoding Each block begins with an header of two unsigned integers. The first value identifies the type of block and the second value provides the size of the block in bytes. The block identifier is used because it is possible for entire blocks to be omitted from the file if they are empty. The block identifier helps the reader determine which kind of block is next in the file. Note that blocks can be nested within other blocks.

All blocks are variable length, and the block header specifies the size of the block. All blocks begin on a byte index that is aligned to an even 32-bit boundary. That is, the first block is 32-bit aligned because it starts at offset 0. Each block is padded with zero fill bytes to ensure that the next block also starts on a 32-bit boundary.

Lists

LLVM Bytecode blocks often contain lists of things of a similar type. For example, a function contains a list of instructions and a function type contains a list of argument types. There are two basic types of lists: length lists (llist), and null terminated lists (zlist), as described below in the Encoding Primitives.

Fields

Fields are units of information that LLVM knows how to write atomically. Most fields have a uniform length or some kind of length indication built into their encoding. For example, a constant string (array of bytes) is written simply as the length followed by the characters. Although this is similar to a list, constant strings are treated atomically and are thus fields.

Fields use a condensed bit format specific to the type of information they must contain. As few bits as possible are written for each field. The sections that follow will provide the details on how these fields are written and how the bits are to be interpreted.

Alignment

To support cross-platform differences, the bytecode file is aligned on certain boundaries. This means that a small amount of padding (at most 3 bytes) will be added to ensure that the next entry is aligned to a 32-bit boundary.

Variable Bit-Rate Encoding

Most of the values written to LLVM bytecode files are small integers. To minimize the number of bytes written for these quantities, an encoding scheme similar to UTF-8 is used to write integer data. The scheme is known as variable bit rate (vbr) encoding. In this encoding, the high bit of each byte is used to indicate if more bytes follow. If (byte & 0x80) is non-zero in any given byte, it means there is another byte immediately following that also contributes to the value. For the final byte (byte & 0x80) is false (the high bit is not set). In each byte only the low seven bits contribute to the value. Consequently 32-bit quantities can take from one to five bytes to encode. In general, smaller quantities will encode in fewer bytes, as follows:

Byte # | Significant Bits | Maximum Value
--- | --- | ---
1 | 0-6 | 127
2 | 7-13 | 16,383
3 | 14-20 | 2,097,151
4 | 21-27 | 268,435,455
5 | 28-34 | 34,359,738,367
6 | 35-41 | 4,398,046,511,103
7 | 42-48 | 562,949,953,421,311
8 | 49-55 | 72,057,594,037,927,935
9 | 56-62 | 9,223,372,036,854,775,807
10 | 63-69 | 1,180,591,620,717,411,303,423

Note that in practice, the tenth byte could only encode bit 63 since the maximum quantity to use this encoding is a 64-bit integer.

Signed VBR values are encoded with the standard vbr encoding, but with the sign bit as the low order bit instead of the high order bit. This allows small negative quantities to be encoded efficiently. For example, -3 is encoded as "((3 << 1) | 1)" and 3 is encoded as "(3 << 1) | 0)", emitted with the standard vbr encoding above.

Encoding Primitives

Each field in the bytecode format is encoded into the file using a small set of primitive formats. The table below defines the encoding rules for the various primitives used and gives them each a type name. The type names used in the descriptions of blocks and fields in the Detailed Layoutnext section. Any type name with the suffix _vbr indicates a quantity that is encoded using variable bit rate encoding as described above.

Type | Rule
--- | ---
unsigned | A 32-bit unsigned integer that always occupies four consecutive bytes. The unsigned integer is encoded using LSB first ordering. That is bits 20 through 27 are in the byte with the lowest file offset (little endian).
uint24_vbr | A 24-bit unsigned integer that occupies from one to four bytes using variable bit rate encoding.
uint32_vbr | A 32-bit unsigned integer that occupies from one to five bytes using variable bit rate encoding.
uint64_vbr | A 64-bit unsigned integer that occupies from one to ten bytes using variable bit rate encoding.
int64_vbr | A 64-bit signed integer that occupies from one to ten bytes using the signed variable bit rate encoding.
char | A single unsigned character encoded into one byte
bit(n-m) | A set of bit within some larger integer field. The values of `n` and `m` specify the inclusive range of bits that define the subfield. The value for `m` may be omitted if its the same as `n`.
float | A floating point value encoded as a 32-bit IEEE value written in little-endian form.
double | A floating point value encoded as a64-bit IEEE value written in little-endian form
string | A uint32_vbr indicating the type of the constant string which also includes its length, immediately followed by the characters of the string. There is no terminating null byte in the string.
data | An arbitrarily long segment of data to which no interpretation is implied. This is used for constant initializers.
llist(x) | A length list of x. This means the list is encoded as an uint32_vbr providing the length of the list, followed by a sequence of that many "x" items. This implies that the reader should iterate the number of times provided by the length.
zlist(x) | A zero-terminated list of x. This means the list is encoded as a sequence of an indeterminate number of "x" items, followed by an uint32_vbr terminating value. This implies that none of the "x" items can have a zero value (or else the list terminates).
block | A block of data that is logically related. A block is an unsigned 32-bit integer that encodes the type of the block in the low 5 bits and the size of the block in the high 27 bits. The length does not include the block header or any alignment bytes at the end of the block. Blocks may compose other blocks.

Field Notation

In the detailed block and field descriptions that follow, a regex like notation is used to describe optional and repeated fields. A very limited subset of regex is used to describe these, as given in the following table:

Character | Meaning
--- | ---
`?` | The question mark indicates 0 or 1 occurrences of the thing preceding it.
`*` | The asterisk indicates 0 or more occurrences of the thing preceding it.
`+` | The plus sign indicates 1 or more occurrences of the thing preceding it.
`()` | Parentheses are used for grouping.
`,` | The comma separates sequential fields.

So, for example, consider the following specifications:

1. `string?`
2. `(uint32_vbr,uin32_vbr)+`
3. `(unsigned?,uint32_vbr)*`
4. `(llist(unsigned))?`

with the following interpretations:

1. An optional string. Matches either nothing or a single string
2. One or more pairs of uint32_vbr.
3. Zero or more occurrences of either an unsigned followed by a uint32_vbr or just a uint32_vbr.
4. An optional length list of unsigned values.

Slots

The bytecode format uses the notion of a "slot" to reference Types and Values. Since the bytecode file is a direct representation of LLVM's intermediate representation, there is a need to represent pointers in the file. Slots are used for this purpose. For example, if one has the following assembly:

`%MyType = type { int, sbyte }
%MyVar = external global %MyType`

there are two definitions. The definition of `%MyVar` uses `%MyType`. In the C++ IR this linkage between `%MyVar` and `%MyType` is explicit through the use of C++ pointers. In bytecode, however, there's no ability to store memory addresses. Instead, we compute and write out slot numbers for every Type and Value written to the file.

A slot number is simply an unsigned 32-bit integer encoded in the variable bit rate scheme (see encoding). This ensures that low slot numbers are encoded in one byte. Through various bits of magic LLVM attempts to always keep the slot numbers low. The first attempt is to associate slot numbers with their "type plane". That is, Values of the same type are written to the bytecode file in a list (sequentially). Their order in that list determines their slot number. This means that slot #1 doesn't mean anything unless you also specify for which type you want slot #1. Types are always written to the file first (in the Global Type Pool) and in such a way that both forward and backward references of the types can often be resolved with a single pass through the type pool.

In summary then, a slot number can be thought of as just a vbr encoded index into a list of Type* or Value*. To keep slot numbers low, Value* are indexed by two slot numbers: the "type plane index" (type slot) and the "value index" (value slot).

General Structure

This section provides the general structure of the LLVM bytecode file format. The bytecode file format requires blocks to be in a certain order and nested in a particular way so that an LLVM module can be constructed efficiently from the contents of the file. This ordering defines a general structure for bytecode files as shown below. The table below shows the order in which all block types may appear. Please note that some of the blocks are optional and some may be repeated. The structure is fairly loose because optional blocks, if empty, are completely omitted from the file.

ID | Parent | Optional? | Repeated? | Level | Block Type | Description
--- | --- | --- | --- | --- | --- | ---
N/A | File | No | No | 0 | Signature | This contains the file signature (magic number) that identifies the file as LLVM bytecode.
0x01 | File | No | No | 0 | Module | This is the top level block in a bytecode file. It contains all the other blocks.
0x06 | Module | No | No | 1 | Global Type Pool | This block contains all the global (module) level types.
0x05 | Module | No | No | 1 | Module Globals Info | This block contains the type, constness, and linkage for each of the global variables in the module. It also contains the type of the functions and the constant initializers.
0x03 | Module | Yes | No | 1 | Module Constant Pool | This block contains all the global constants except function arguments, global values and constant strings.
0x02 | Module | Yes | Yes | 1 | Function Definitions* | One function block is written for each function in the module. The function block contains the instructions, type constant pool, and symbol table for the function.
0x03 | Function | Yes | No | 2 | Function Constant Pool | Any constants (including types) used solely within the function are emitted here in the function constant pool.
0x07 | Function | No | No | 2 | Instruction List | This block contains all the instructions of the function. The basic blocks are inferred by terminating instructions.
0x04 | Function | Yes | No | 2 | Function Symbol Table | This symbol table provides the names for the function specific values used (basic block labels mostly).
0x04 | Module | Yes | No | 1 | Module Symbol Table | This symbol table provides the names for the various entries in the file that are not function specific (global vars, and functions mostly).

Use the links in the table for details about the contents of each of the block types.

Block Definitions

This section provides the detailed layout of the individual block types in the LLVM bytecode file format.

Signature Block

The signature occurs in every LLVM bytecode file and is always first. It simply provides a few bytes of data to identify the file as being an LLVM bytecode file. This block is always four bytes in length and differs from the other blocks because there is no identifier and no block length at the start of the block. Essentially, this block is just the "magic number" for the file.

There are two types of signatures for LLVM bytecode: uncompressed and compressed as shown in the table below.

Type | Uncompressed | Compressed
--- | --- | ---
char | Constant "l" (0x6C) | Constant "l" (0x6C)
char | Constant "l" (0x6C) | Constant "l" (0x6C)
char | Constant "v" (0x76) | Constant "v" (0x76)
char | Constant "m" (0x6D) | Constant "c" (0x63)
char | N/A | '0'=null,'1'=gzip,'2'=bzip2

In other words, the uncompressed signature is just the characters 'llvm' while the compressed signature is the characters 'llvc' followed by an ascii digit ('0', '1', or '2') that indicates the kind of compression used. A value of '0' indicates that null compression was used. This can happen when compression was requested on a platform that wasn't configured for gzip or bzip2. A value of '1' means that the rest of the file is compressed using the gzip algorithm and should be uncompressed before interpretation. A value of '2' means that the rest of the file is compressed using the bzip2 algorithm and should be uncompressed before interpretation. In all cases, the data resulting from uncompression should be interpreted as if it occurred immediately after the 'llvm' signature (i.e. the uncompressed data begins with the Module Block

NOTE: As of LLVM 1.4, all bytecode files produced by the LLVM tools are compressed by default. To disable compression, pass the `--disable-compression` option to the tool, if it supports it.

Module Block

The module block contains a small pre-amble and all the other blocks in the file. The table below shows the structure of the module block. Note that it only provides the module identifier, size of the module block, and the format information. Everything else is contained in other blocks, described in other sections.

Type | Field Description
--- | ---
unsigned | Module Block Identifier (0x01)
unsigned | Module Block Size
uint32_vbr | Format Information
block | Global Type Pool
block | Module Globals Info
block | Module Constant Pool
block* | Function Definitions
block | Module Symbol Table

Module Block Header

The block header for the module block uses a longer format than the other blocks in a bytecode file. Specifically, instead of encoding the type and size of the block into a 32-bit integer with 5-bits for type and 27-bits for size, the module block header uses two 32-bit unsigned values, one for type, and one for size. While the 227 byte limit on block size is sufficient for the blocks contained in the module, it isn't sufficient for the module block itself because we want to ensure that bytecode files as large as 232 bytes are possible. For this reason, the module block (and only the module block) uses a long format header.

Format Information

The format information field is encoded into a uint32_vbr.

Of particular note, the bytecode format number is simply a 32-bit monotonically increasing integer that identifies the version of the bytecode format (which is not directly related to the LLVM release number). The bytecode versions defined so far are (note that this document only describes the latest version, 2.0):

- #0: LLVM 1.0 & 1.1
- #1: LLVM 1.2
- #2: LLVM 1.2.5 (not released)
- #3: LLVM 1.3
- #4: LLVM 1.3.x (not released)
- #5: LLVM 1.4 through 1.8
- #6: LLVM 1.9
- #7: LLVM 2.0 and newer

Global Type Pool

The global type pool consists of type definitions. Their order of appearance in the file determines their type slot number (0 based). Slot numbers are used to replace pointers in the intermediate representation. Each slot number uniquely identifies one entry in a type plane (a collection of values of the same type). Since all values have types and are associated with the order in which the type pool is written, the global type pool must be written as the first block of a module. If it is not, attempts to read the file will fail because both forward and backward type resolution will not be possible.

The type pool is simply a list of type definitions, as shown in the table below.

Type | Field Description
--- | ---
block | Type Pool Identifier (0x06) + Size
llist(type) | A length list of type definitions.

Type Definitions

Types in the type pool are defined using a different format for each kind of type, as given in the following sections.

### Primitive Types

The primitive types encompass the basic integer and floating point types. They are encoded simply as their TypeID.

Type | Description
--- | ---
uint24_vbr | Type ID for the primitive types (values 1 to 11) 1

Notes:

1. The values for the Type IDs for the primitive types are provided by the definition of the `llvm::Type::TypeID` enumeration in `include/llvm/Type.h`. The enumeration gives the following mapping:
   1. bool
   2. ubyte
   3. sbyte
   4. ushort
   5. short
   6. uint
   7. int
   8. ulong
   9. long
   10. float
   11. double

### Function Types

Type | Description
--- | ---
uint24_vbr | Type ID for function types (13)
uint24_vbr | Type slot number of function's return type.
llist(uint24_vbr) | Type slot number of each argument's type.
uint32_vbr? | Value 0 if this is a varargs function, missing otherwise.

### Structure Types

Type | Description
--- | ---
uint24_vbr | Type ID for structure types (14)
zlist(uint24_vbr) | Slot number of each of the element's fields.

### Array Types

Type | Description
--- | ---
uint24_vbr | Type ID for Array Types (15)
uint24_vbr | Type slot number of array's element type.
uint32_vbr | The number of elements in the array.

### Pointer Types

Type | Description
--- | ---
uint24_vbr | Type ID For Pointer Types (16)
uint24_vbr | Type slot number of pointer's element type.

### Opaque Types

Type | Description
--- | ---
uint24_vbr | Type ID For Opaque Types (17)

### Packed Types

Type | Description
--- | ---
uint24_vbr | Type ID for Packed Types (18)
uint24_vbr | Slot number of packed vector's element type.
uint32_vbr | The number of elements in the packed vector.

### Packed Structure Types

Type | Description
--- | ---
uint24_vbr | Type ID for packed structure types (19)
zlist(uint24_vbr) | Slot number of each of the element's fields.

Module Global Info

The module global info block contains the definitions of all global variables including their initializers and the declaration of all functions. The format is shown in the table below:

Type | Field Description
--- | ---
block | Module global info identifier (0x05) + size
zlist(globalvar) | A zero terminated list of global var definitions occurring in the module.
zlist(funcfield) | A zero terminated list of function definitions occurring in the module.
llist(string) | A length list of strings that specify the names of the libraries that this module depends upon.
string | The target triple for the module (blank means no target triple specified, i.e. a platform-independent module).
string | The data layout string describing the endianness, pointer size, and type alignments for which the module was written (blank means no data layout specified, i.e. a platform-independent module).
llist(string) | A length list of strings that defines a table of section strings for globals. A global's SectionID is an index into this table.
string | The inline asm block for this module.

Global Variable Field

Global variables are written using an uint32_vbr that encodes information about the global variable, an optional extension vbr, and a an optional initializers for the global var.

The table below provides the bit layout of the first uint32_vbr that describes the global variable.

Type | Description
--- | ---
bit(0) | Is constant?
bit(1) | Has initializer? Note that this bit determines whether the constant initializer field (described below) follows.
bit(2-4) | Linkage type: 0=External, 1=Weak, 2=Appending, 3=Internal, 4=LinkOnce, 5=DllImport, 6=DllExport, 7=ExternWeak
bit(5-31) | Type slot number of type for the global variable.

When the Linkage type is set to 3 (internal) and the initializer field is set to 0 (an invalid combination), an extension word follows the first uint32_vbr which encodes the real linkage and init flag, and can includes more information:

Type | Description
--- | ---
bit(0) | Has initializer? Indicates the real value of the "Has initializer" field for the global.
bit(2-4) | Linkage type: Indicates the real value of the "linkage type" field for the global.
bit(4-8) | The log-base-2 of the alignment for the global.
bit(9) | If this bit is set, a SectionID follows this vbr.
bit(10-12) | Visibility style: 0=Default, 1=Hidden.
bit(13-31) | Currently unassigned.

If the SectionID bit is set above, the following field is included:

Type | Description
--- | ---
uint32_vbr | An optional section ID number, specifying the string to use for the section of the global. This an index (+1) of an entry into the SectionID llist in the Module Global Info block. If this value is 0 or not present, the global has an empty section string.

If the "Has initializer" field is set, the following field is included:

Type | Description
--- | ---
uint32_vbr | An optional value slot number for the global variable's constant initializer.

Function Field

Functions are written using an uint32_vbr that encodes information about the function and a set of flags. If needed, an extension word may follow this first field.

The table below provides the bit layout of the uint32_vbr that describes the function.

Type | Description
--- | ---
bit(0-3) | Encodes the calling convention number of the function. The CC number of the function is the value of this field minus one.
bit(4) | If this bit is set to 1, the indicated function is external, and there is no Function Definiton Block in the bytecode file for the function. If the function is external and has `dllimport or extern_weak` linkage additional field in the extension word is used to indicate the actual linkage type.
bit(5-30) | Type slot number of type for the function.
bit(31) | Indicates whether an extension word follows.

If bit(31) is set, an additional uint32_vbr word follows with the following fields:

Type | Description
--- | ---
bit(0-4) | The log-base-2 of the alignment for the function.
bit(5-9) | The top nibble of the calling convention.
bit(10) | If this bit is set, a SectionID follows this vbr.
bit(11-12) | Linkage type for external functions. 0 - External linkage, 1 - DLLImport linkage, 2 - External weak linkage.
bit(13-31) | Currently unassigned.

If the SectionID bit is set above, the following field is included:

Type | Description
--- | ---
uint32_vbr | An optional section ID number, specifying the string to use for the section of the function. This an index (+1) of an entry into the SectionID llist in the Module Global Info block. If this value is 0 or not present, the function has an empty section string.

Constant Pool

A constant pool defines as set of constant values. There are actually two types of constant pool blocks: one for modules and one for functions. For modules, the block begins with the constant strings encountered anywhere in the module. For functions, the block begins with types only encountered in the function. In both cases the header is identical. The tables that follow, show the header, module constant pool preamble, function constant pool preamble, and the part common to both function and module constant pools.

Common Block Header

Type | Field Description
--- | ---
block | Constant pool identifier (0x03) + size

Module Constant Pool Preamble (constant strings)

Type | Field Description
--- | ---
uint32_vbr | The number of constant strings that follow.
uint32_vbr | Zero. This identifies the following "plane" as containing the constant strings. This is needed to identify it uniquely from other constant planes that follow.
uint24_vbr+ | Type slot number of the constant string's type. Note that the constant string's type implicitly defines the length of the string.

Function Constant Pool Preamble (function types)

The structure of the types for functions is identical to the Global Type Pool. Please refer to that section for the details.

Common Part (other constants)

Type | Field Description
--- | ---
uint32_vbr | Number of entries in this type plane.
uint24_vbr | Type slot number of this plane.
constant+ | The definition of a constant (see below).

Simple Constant Pool Entries

Constant pool entries come in many shapes and flavors. The sections that follow define the format for each of them. All constants start with a uint32_vbr encoded integer that provides the number of operands for the constant. For primitive, structure, and array constants, this will always be zero to indicate that the form of the constant is solely determined by its type. In this case, we have the following field definitions, based on type:

- Bool. This is written as an uint32_vbr of value 1U or 0U.
- Signed Integers (sbyte,short,int,long). These are written as an int64_vbr with the corresponding value.
- Unsigned Integers (ubyte,ushort,uint,ulong). These are written as an uint64_vbr with the corresponding value.
- Floating Point. Both the float and double types are written literally in binary format.
- Arrays. Arrays are written simply as a list of uint32_vbr encoded value slot numbers to the constant element values.
- Structures. Structures are written simply as a list of uint32_vbr encoded value slot numbers to the constant field values of the structure.

Undef Entries

When the number of operands to the constant is one, we have an 'undef' value of the specified type.

Inline Assembler Entries

Inline Assembler entries are stored in the constant pool, though they are not officially LLVM constants. These entries are marked with a value of "4294967295" (all ones) for the number of operands. They are encoded as follows:

Type | Field Description
--- | ---
string | The asm string.
string | The constraints string.
uint32_vbr | Flags

Currently, the only defined flag, the low bit, indicates whether or not the inline assembler has side effects.

Constant Expression Entries

Otherwise, we have a constant expression. The format of the constant expression is specified in the table below, and the number is equal to the number of operands+1.

Type | Field Description
--- | ---
uint32_vbr | Op code of the instruction for the constant expression.
uint32_vbr | The value slot number of the constant value for an operand.1
uint24_vbr | The type slot number for the type of the constant value for an operand.1

Notes:

1. Both these fields are repeatable but only in pairs.

Function Definition

Function definitions contain the linkage, constant pool, instruction list, and symbol table for a function. The following table shows the structure of a function definition.

Type | Field Description
--- | ---
block | Function definition block identifier (0x02) + size
uint32_vbr | The linkage and visibility style field
block | The constant pool block for this function.2
block | The instruction list for the function.
block | The function's symbol table containing only those symbols pertinent to the function (mostly block labels).

Notes:

1. Note that if the linkage type is "External" then none of the other fields will be present as the function is defined elsewhere.

Linkage and visibility word

Type | Field Description
--- | ---
bit(0-15) | The linkage type of the function: 0=External, 1=Weak, 2=Appending, 3=Internal, 4=LinkOnce, 5=DllImport, 6=DllExport1
bit(16-18) | Visibility style: 0=Default, 1=Hidden.
bit(19-31) | Currently unassigned.

Instruction List

The instructions in a function are written as a simple list. Basic blocks are inferred by the terminating instruction types. The format of the block is given in the following table.

Type | Field Description
--- | ---
block | Instruction list identifier (0x07) + size
instruction+ | An instruction. Instructions have a variety of formats. See Instructions for details.

Instructions

Instructions are written out one at a time as distinct units. Each instruction record contains at least an opcode and a type field, and may contain a list of operands (whose interpretation depends on the opcode). Based on the number of operands, the instruction is encoded in a dense format that tries to encoded each instruction into 32-bits if possible.

Instruction Opcodes

Instructions encode an opcode that identifies the kind of instruction. Opcodes are an enumerated integer value. The specific values used depend on the version of LLVM you're using. The opcode values are defined in the `include/llvm/Instruction.def` file. You should check there for the most recent definitions. The table below provides the opcodes defined as of the writing of this document. The table associates each opcode mnemonic with its enumeration value and the bytecode and LLVM version numbers in which the opcode was introduced.

Opcode | Number | Bytecode Version | LLVM Version
--- | --- | --- | ---
Terminator Instructions
Ret | 1 | 1 | 1.0
Br | 2 | 1 | 1.0
Switch | 3 | 1 | 1.0
Invoke | 4 | 1 | 1.0
Unwind | 5 | 1 | 1.0
Unreachable | 6 | 1 | 1.4
Binary Operators
Add | 7 | 1 | 1.0
Sub | 8 | 1 | 1.0
Mul | 9 | 1 | 1.0
UDiv | 10 | 6 | 1.9
SDiv | 11 | 6 | 1.9
FDiv | 12 | 6 | 1.9
URem | 13 | 6 | 1.9
SRem | 14 | 6 | 1.9
FRem | 15 | 6 | 1.9
Logical Operators
Shl | 16 | 1 | 1.0
LShr | 17 | 6 | 1.9
AShr | 18 | 6 | 1.9
And | 19 | 1 | 1.0
Or | 20 | 1 | 1.0
Xor | 21 | 1 | 1.0
Memory Operators
Malloc | 22 | 1 | 1.0
Free | 23 | 1 | 1.0
Alloca | 24 | 1 | 1.0
Load | 25 | 1 | 1.0
Store | 26 | 1 | 1.0
GetElementPtr | 27 | 1 | 1.0
Cast Operators
Trunc | 28 | 7 | 2.0
ZExt | 29 | 7 | 2.0
SExt | 30 | 7 | 2.0
FPToUI | 31 | 7 | 2.0
FPToSI | 32 | 7 | 2.0
UIToFP | 33 | 7 | 2.0
SIToFP | 34 | 7 | 2.0
FPTrunc | 35 | 7 | 2.0
FPExt | 36 | 7 | 2.0
PtrToInt | 37 | 7 | 2.0
IntToPtr | 38 | 7 | 2.0
BitCast | 39 | 7 | 2.0
Other Operators
ICmp | 40 | 7 | 2.0
FCmp | 41 | 7 | 2.0
PHI | 42 | 1 | 1.0
Call | 43 | 1 | 1.0
Select | 44 | 2 | 1.2
UserOp1 | 45 | 1 | 1.0
UserOp2 | 46 | 1 | 1.0
VAArg | 47 | 5 | 1.5
ExtractElement | 48 | 5 | 1.5
InsertElement | 49 | 5 | 1.5
ShuffleElement | 50 | 5 | 1.5
Pseudo Instructions*
Invoke+CC | 56 | 5 | 1.5
Invoke+FastCC | 57 | 5 | 1.5
Call+CC | 58 | 5 | 1.5
Call+FastCC+TailCall | 59 | 5 | 1.5
Call+FastCC | 60 | 5 | 1.5
Call+CCC+TailCall | 61 | 5 | 1.5
Load+Volatile | 62 | 3 | 1.3
Store+Volatile | 63 | 3 | 1.3

* Note: These aren't really opcodes from an LLVM language perspective. They encode information into other opcodes without reserving space for that information. For example, opcode=63 is a Volatile Store. The opcode for this instruction is 25 (Store) but we encode it as 63 to indicate that is a Volatile Store. The same is done for the calling conventions and tail calls. In each of these entries in range 56-63, the opcode is documented as the base opcode (Invoke, Call, Store) plus some set of modifiers, as follows:

CC
  This means an arbitrary calling convention is specified in a VBR that follows the opcode. This is used when the instruction cannot be encoded with one of the more compact forms.
FastCC
  This indicates that the Call or Invoke is using the FastCC calling convention.
CCC
  This indicates that the Call or Invoke is using the native "C" calling convention.
TailCall
  This indicates that the Call has the 'tail' modifier.

Instruction Operands

Based on the instruction opcode and type, the bytecode format implicitly (to save space) specifies the interpretation of the operand list. For most instructions, the type of each operand is implicit from the type of the instruction itself (e.g. the type of operands of a binary operator must match the type of the instruction). As such, the bytecode format generally only encodes the value number of the operand, not the type.

In some cases, however, this is not sufficient. This section enumerates those cases:

- getelementptr: the slot numbers for sequential type indexes are shifted up two bits. This allows the low order bits will encode the type of index used, as follows: 0=uint, 1=int, 2=ulong, 3=long.
- cast: the result type number is encoded as the second operand.
- alloca/malloc: If the allocation has an explicit alignment, the log2 of the alignment is encoded as the second operand.
- call: If the tail marker and calling convention cannot be encoded into the opcode of the call, it is passed as an additional operand. The low bit of the operand is a flag indicating whether the call is a tail call. The rest of the bits contain the calling convention number (shifted left by one bit).

Instruction Encoding

For brevity, instructions are written in one of four formats, depending on the number of operands to the instruction. Each instruction begins with a uint32_vbr that encodes the type of the instruction as well as other things. The tables that follow describe the format of this first part of each instruction.

Instruction Format 0

This format is used for a few instructions that can't easily be shortened because they have large numbers of operands (e.g. PHI Node or getelementptr). Each of the opcode, type, and operand fields is found in successive fields.

Type | Field Description
--- | ---
uint32_vbr | Specifies the opcode of the instruction. Note that for compatibility with the other instruction formats, the opcode is shifted left by 2 bits. Bits 0 and 1 must have value zero for this format.
uint24_vbr | Provides the type slot number of the result type of the instruction.
uint32_vbr | The number of operands that follow.
uint32_vbr+ | The slot number of the value(s) for the operand(s).

Instruction Format 1

This format encodes the opcode, type and a single operand into a single uint32_vbr as follows:

Bits | Type | Field Description
--- | --- | ---
0-1 | constant "1" | These two bits must be the value 1 which identifies this as an instruction of format 1.
2-7 | opcode | Specifies the opcode of the instruction. Note that the maximum opcode value is 63.
8-19 | unsigned | Specifies the slot number of the type for this instruction. Maximum slot number is 212-1=4095.
20-31 | unsigned | Specifies the slot number of the value for the first operand. Maximum slot number is 212-1=4095. Note that the value 212-1 denotes zero operands.

Instruction Format 2

This format encodes the opcode, type and two operands into a single uint32_vbr as follows:

Bits | Type | Field Description
--- | --- | ---
0-1 | constant "2" | These two bits must be the value 2 which identifies this as an instruction of format 2.
2-7 | opcode | Specifies the opcode of the instruction. Note that the maximum opcode value is 63.
8-15 | unsigned | Specifies the slot number of the type for this instruction. Maximum slot number is 28-1=255.
16-23 | unsigned | Specifies the slot number of the value for the first operand. Maximum slot number is 28-1=255.
24-31 | unsigned | Specifies the slot number of the value for the second operand. Maximum slot number is 28-1=255.

Instruction Format 3

This format encodes the opcode, type and three operands into a single uint32_vbr as follows:

Bits | Type | Field Description
--- | --- | ---
0-1 | constant "3" | These two bits must be the value 3 which identifies this as an instruction of format 3.
2-7 | opcode | Specifies the opcode of the instruction. Note that the maximum opcode value is 63.
8-13 | unsigned | Specifies the slot number of the type for this instruction. Maximum slot number is 26-1=63.
14-19 | unsigned | Specifies the slot number of the value for the first operand. Maximum slot number is 26-1=63.
20-25 | unsigned | Specifies the slot number of the value for the second operand. Maximum slot number is 26-1=63.
26-31 | unsigned | Specifies the slot number of the value for the third operand. Maximum slot number is 26-1=63.

Symbol Table

A symbol table can be put out in conjunction with a module or a function. A symbol table has a list of name/type associations followed by a list of name/value associations. The name/value associations are organized into "type planes" so that all values of a common type are listed together. Each type plane starts with the number of entries in the plane and the type slot number for all the values in that plane (so the type can be looked up in the global type pool). For each entry in a type plane, the slot number of the value and the name associated with that value are written. The format is given in the table below.

Type | Field Description
--- | ---
block | Symbol Table Identifier (0x04)
llist(type_entry) | A length list of symbol table entries for `Type`s
llist(symtab_plane) | A length list of "type planes" of symbol table entries for `Value`s

Symbol Table Type Entry

A symbol table type entry associates a name with a type. The name is provided simply as an array of chars. The type is provided as a type slot number (index) into the global type pool. The format is given in the following table:

Type | Field Description
--- | ---
uint24_vbr | Type slot number of the type being given a name relative to the global type pool.
uint32_vbr | Length of the character array that follows.
char+ | The characters of the name.

Symbol Table Plane

A symbol table plane provides the symbol table entries for all values of a common type. The encoding is given in the following table:

Type | Field Description
--- | ---
uint32_vbr | Number of entries in this plane.
uint32_vbr | Type slot number of type for all values in this plane.
value_entry+ | The symbol table entries for to associate values with names.

Symbol Table Value Entry

A symbol table value entry provides the assocation between a value and the name given to the value. The value is referenced by its slot number. The format is given in the following table:

Type | Field Description
--- | ---
uint24_vbr | Value slot number of the value being given a name.
uint32_vbr | Length of the character array that follows.
char+ | The characters of the name.

Version Differences

This section describes the differences in the Bytecode Format across LLVM versions. The versions are listed in reverse order because it assumes the current version is as documented in the previous sections. Each section here describes the differences between that version and the one that follows.

Version 1.3 Differences From 1.4
Unreachable Instruction

The LLVM Unreachable instruction was added in version 1.4 of LLVM. This caused all instruction numbers after it to shift down by one.

Function Flags

LLVM bytecode versions prior to 1.4 did not include the 5 bit offset in the function list in the Module Global Info block.

Function Flags

LLVM bytecode versions prior to 1.4 did not include the 'undef' constant value, which affects the encoding of Constant Fields.

Version 1.2 Differences From 1.3
Type Derives From Value

In version 1.2, the Type class in the LLVM IR derives from the Value class. This is not the case in version 1.3. Consequently, in version 1.2 the notion of a "Type Type" was used to write out values that were Types. The types always occuped plane 12 (corresponding to the TypeTyID) of any type planed set of values. In 1.3 this representation is not convenient because the TypeTyID (12) is not present and its value is now used for LabelTyID. Consequently, the data structures written that involve types do so by writing all the types first and then each of the value planes according to those types. In version 1.2, the types would have been written intermingled with the values.

Restricted getelementptr Types

In version 1.2, the getelementptr instruction required a ubyte type index for accessing a structure field and a long type index for accessing an array element. Consequently, it was only possible to access structures of 255 or fewer elements. Starting in version 1.3, this restriction was lifted. Structures must now be indexed with uint constants. Arrays may now be indexed with int, uint, long, or ulong typed values. The consequence of this was that the bytecode format had to change in order to accommodate the larger range of structure indices.

Short Block Headers

In version 1.2, block headers were always 8 bytes being comprised of both an unsigned integer type and an unsigned integer size. For very small modules, these block headers turn out to be a large fraction of the total bytecode file size. In an attempt to make these small files smaller, the type and size information was encoded into a single unsigned integer (4 bytes) comprised of 5 bits for the block type (maximum 31 block types) and 27 bits for the block size (max ~134MBytes). These limits seemed sufficient for any blocks or sizes forseen in the future. Note that the module block, which encloses all the other blocks is still written as 8 bytes since bytecode files larger than 134MBytes might be possible.

Dependent Libraries and Target Triples

In version 1.2, the bytecode format does not store module's target triple or dependent. These fields have been added to the end of the module global info block. The purpose of these fields is to allow a front end compiler to specifiy that the generated module is specific to a particular target triple (operating system/manufacturer/processor) which makes it non-portable; and to allow front end compilers to specify the list of libraries that the module depends on for successful linking.

Types Restricted to 24-bits

In version 1.2, type slot identifiers were written as 32-bit VBR quantities. In 1.3 this has been reduced to 24-bits in order to ensure that it is not possible to overflow the type field of a global variable definition. 24-bits for type slot numbers is deemed sufficient for any practical use of LLVM.

Version 1.1 Differences From 1.2
Explicit Primitive Zeros

In version 1.1, the zero value for primitives was explicitly encoded into the bytecode format. Since these zero values are constant values in the LLVM IR and never change, there is no reason to explicitly encode them. This explicit encoding was removed in version 1.2.

Inconsistent Module Global Info

In version 1.1, the Module Global Info block was not aligned causing the next block to be read in on an unaligned boundary. This problem was corrected in version 1.2.

Version 1.0 Differences From 1.1

None. Version 1.0 and 1.1 bytecode formats are identical.