Unhandled parts of the LLVM IR

[delcypher]

This issues tracks LLVM instructions, intrinsics, etc. that KLEE is known not to handle. Each item is checked once support has been added.

• llvm.bswap.* Modern docs. Introduced in LLVM 1.7. First reported in llvm error in the latest klee #660.
• blockaddress Modern docs. Introduced in LLVM 2.7. First reported in klee can't handle when the constant is a statement label #615
• indirectbr Modern docs. Introduced in LLVM 2.7. First reported (indirectly) in klee can't handle when the constant is a statement label #615
• llvm.is.constant.*. First reported below.
• Saturated arithmetic. First reported in LLVM ERROR: Code generator does not support intrinsic function 'llvm.usub.sat.i64'! #1154
• llvm.rint.*. First reported in LLVM ERROR: Code generator does not support intrinsic function 'llvm.rint.f64'! #1232
• llvm.minnum.*, llvm.maxnum.*,llvm.minimum,llvm.maximum. First reported in LLVM ERROR: Code generator does not support intrinsic function 'llvm.minnum.f64'! #1238
• llvm.fshl.*, ‘llvm.fshr.*. First reported in Assertion failure for Rust code #1263
• llvm.x86.sse2.*. First reported in How to fix LLVM intrinsic function lost  #1091.
• llvm.x86.sse42.crc32.*. First reported here.
• llvm.sadd.sat.v8i16 etc. First reported Fixed a crash in the operation of 128-bit variables in the sse instruction set of the x86/x64 architecture #1457

[ccadar]

Added blockaddress and indirectbr, reported in #615

[251]

LLVM8: sha256sum runs into:

ERROR: Code generator does not support intrinsic function 'llvm.is.constant.i32'

https://llvm.org/docs/LangRef.html#llvm-is-constant-intrinsic

This should be lowered before execution.

[arrowd]

I also bumped into llvm.is.constant.i32 when fiddling with FreeBSD libc support.

[arrowd]

I did a bit of research on llvm.is.constant. It seems to be handled in lib/Analysis/ConstantFolding.cpp and boils down to this:

static bool isManifestConstant(const Constant *c) {
  if (isa<ConstantData>(c)) {
    return true;
  } else if (isa<ConstantAggregate>(c) || isa<ConstantExpr>(c)) {
    for (const Value *subc : c->operand_values()) {
      if (!isManifestConstant(cast<Constant>(subc)))
        return false;
    }
    return true;
  }
  return false;
}

There is a user-facing API to perform this lowering - llvm::ConstantFoldInstruction. Calls to llvm.is.constant that are still present after ConstantFoldInstruction are lowered in the backend lands with

case Intrinsic::is_constant: {
  // If is_constant hasn't folded away yet, lower it to false now.
  Constant *RetVal = ConstantInt::get(II->getType(), 0);
  resetIteratorIfInvalidatedWhileCalling(BB, [&]() {
    replaceAndRecursivelySimplify(CI, RetVal, TLInfo, nullptr);
  });
  return true;
}

So, my plan is to apply llvm::ConstantFoldInstruction to each call @llvm.is.constant.*() instruction in the bitcode and if the call is untouched, replace it with i1 0. Sounds good?

[jyn514]

Another unsupported intrinsic:

KLEE: output directory is "/home/joshua/src/rust/saltwater/klee-out-0"
KLEE: Using STP solver backend
LLVM ERROR: Code generator does not support intrinsic function 'llvm.x86.sse2.pmovmskb.128'!

swcc.zip

[ccadar]

@jyn514 Thanks, I added it to the list. We need to understand why these are not eliminated like other vectorized intrinsics.
@MartinNowack any thoughts?

[operasfantom]

Another interesting group of intrinsics llvm.x86.sse42.crc32.* is not supported either. I would propose to use C++ equivalent based on Google's implementation .

[ccadar]

@operasfantom thanks, I added them to the list.