IL Overview

The Intermediate Language (IL) is EDG's central data structure -- a typed, scope-linked graph of every declaration, type, expression, statement, and template in the translation unit. cudafe++ (EDG 6.6) builds the IL during parsing, walks it for CUDA device/host separation, and emits it as the .int.c output. The IL never touches disk: IL_SHOULD_BE_WRITTEN_TO_FILE=0 forces in-memory-only operation. All IL nodes live in a region-based arena allocator, organized into file-scope (region 1) and per-function (region N) memory pools.

The IL is versioned as IL_VERSION_NUMBER="6.6" and carries the compile-time flag ALL_TEMPLATE_INFO_IN_IL=1, meaning template definitions, specializations, and instantiation directives are fully represented in the IL graph rather than deferred to a separate template database.

Key Configuration Constants

IL Entry Kind System

Every IL node carries an entry_kind byte that identifies its type. The name table off_E6DD80 (aliased as il_entry_kind_names at off_E6E020) maps these bytes to human-readable strings. The il_one_time_init function (sub_5CF7F0) validates that this table ends with a "last" sentinel.

There are 85 defined entry kind values (0-84). Some are primary node types with their own linked lists; others are auxiliary records displayed inline by their parent.

Complete il_entry_kind Table

Inline entries (kinds 4, 5, 14, 15, 19, 20, 27, 34, 37, 38, 40, 45-48, 69, 75-78, 81) are displayed as part of their parent node rather than as standalone IL entries. The display dispatcher (sub_5F4930) returns immediately for these kinds.

IL Header Structure

The IL header lives in the BSS segment at 0x126EB60 and is printed by display_il_header_and_file_scope (sub_5F76B0). It records translation-unit-level metadata:

struct il_header {                        // at xmmword_126EB60
    il_entry*   primary_source_file;      // +0x00  head of source file list
    scope*      primary_scope;            // +0x08  file-scope root
    routine*    main_routine;             // +0x10  main() if present
    char*       compiler_version;         // +0x18  "6.6" version string
    char*       time_of_compilation;      // +0x20  build timestamp
    uint8_t     plain_chars_are_signed;   // +0x28  signedness of plain char
    uint32_t    source_language;          // +0x2C  0=C++, 1=C (dword_126EBA8)
    uint32_t    std_version;             // +0x30  e.g. 201703 (dword_126EBAC)
    uint8_t     pcc_compatibility_mode;   // +0x34  PCC compat flag
    uint8_t     enum_type_is_integral;    // +0x35
    uint32_t    default_max_member_align; // +0x38
    uint8_t     gcc_mode;                // +0x3C  GCC compatibility
    uint8_t     gpp_mode;                // +0x3D  G++ compatibility
    uint32_t    gnu_version;             // +0x40  e.g. 40201
    uint8_t     short_enums;             // +0x44
    uint8_t     default_nocommon;         // +0x45
    uint8_t     UCN_identifiers_used;     // +0x46
    uint8_t     vla_used;                // +0x47
    uint8_t     any_templates_seen;       // +0x48
    uint8_t     prototype_instantiations_in_il;     // +0x49
    uint8_t     il_has_all_prototype_instantiations; // +0x4A
    uint8_t     il_has_C_semantics;       // +0x4B
    uint8_t     nontag_types_used_in_exception_or_rtti; // +0x4C
    il_entry*   seq_number_lookup_entries; // +0x50
    uint32_t    target_configuration_index; // +0x58
};

The source_language field selects the display string "sl_Cplusplus" or "sl_C". When source_language == 1 (C mode) and std_version > 199900, the routine display additionally prints C99 pragma state fields (fp_contract, fenv_access, cx_limited_range).

Memory Region System

IL entries are allocated in numbered memory regions managed by a bump allocator (sub_6B7D60):

Region 1 contains all file-scope declarations: types, global variables, function declarations, namespaces, templates. Regions 2+ are allocated one per function definition and hold that function's local variables, statements, expressions, labels, and temporaries. The region table at qword_126EC88 maps region indices to their memory, while qword_126EB90 maps region indices to their associated scope entries. dword_126EC80 tracks the total number of regions.

The allocator selects file-scope vs function-scope by comparing dword_126EB40 == dword_126EC90. When equal, the node goes into region 1; otherwise it goes into the current function region. Some node types force a specific region:

• Labels (alloc_label at sub_5E5CA0): Assert that the current region is NOT file scope
• Templates (alloc_template at sub_5E8D20): Always file-scope only
• Sequence number lookups (sub_5E9170): Force region 1 by temporarily setting TU-copy mode

The display system (sub_5F7DF0) iterates all regions:

// File scope
printf("Intermediate language for memory region 1 (file scope):");
walk_file_scope_il(display_il_entry, ...);   // sub_60E4F0

// Per-function regions
for (int r = 2; r <= region_count; r++) {
    scope* s = scope_table[r];
    routine* fn = s->assoc_routine;
    printf("Intermediate language for memory region %ld (function \"%s\"):",
           r, fn->name);
    walk_routine_scope_il(r, display_il_entry, ...);  // sub_610200
}

IL Entry Prefix

Every IL node has a multi-qword prefix preceding the node body. The prefix size depends on allocation mode: 24 bytes (3 qwords) in normal file-scope mode, 16 bytes (2 qwords) in TU-copy mode, and 8 bytes (1 qword) for function-scope allocations. The allocator (sub_6B7D60) allocates a contiguous block and the caller returns a pointer past the prefix, so the prefix occupies negative offsets from the returned node pointer.

Normal file-scope mode (dword_106BA08 == 0, dword_126F694 = 24):

Raw allocation layout (normal file-scope, 24-byte prefix):
Offset  Size  Field
------  ----  -----
+0      8     translation_unit_copy_address   (qword, zeroed in normal mode)
+8      8     next_in_list                    (qword, linked list pointer)
+16     8     prefix flags qword              (flags byte at +16, 7 bytes padding)
+24     ...   node body starts here           (returned pointer)

Node pointer perspective (ptr = raw + 24):
ptr - 24  = TU copy address   (8 bytes at raw+0)
ptr - 16  = next pointer       (8 bytes at raw+8)
ptr - 8   = prefix flags byte  (8 bytes at raw+16, flags in low byte)
ptr + 0   = first byte of node body

TU-copy mode (dword_106BA08 != 0, dword_126F694 = 16):

Raw allocation layout (TU-copy mode, 16-byte prefix):
+0      8     next_in_list                    (no TU copy slot)
+8      8     prefix flags qword
+16     ...   node body starts here           (returned pointer)

Function-scope allocations (dword_126F68C = 8):

Raw allocation layout (function-scope, 8-byte prefix):
+0      8     prefix flags qword              (no TU copy, no orphan slot)
+8      ...   node body starts here           (returned pointer)

The prefix flags byte is at ptr - 8 from the returned node pointer (in all modes). The next_in_list pointer at ptr - 16 is the linked list link used by the IL walker to traverse all entries of a given kind (file-scope only). The translation_unit_copy_address at ptr - 24 stores the original address when a node is copied between translation units; it is zeroed in normal mode and absent in TU-copy and function-scope modes.

The keep_in_il test throughout cudafe++ uses *(signed char*)(entry - 8) < 0 to check bit 7 of the prefix flags byte -- this works because the flags byte is always at offset -8 from the node pointer regardless of allocation mode.

Prefix Flags Byte

The prefix flags byte (at offset -8 from the returned node pointer) encodes scope and language information:

Bit 7 (keep_in_il) is the mechanism by which cudafe++ selects device-relevant declarations. The mark_to_keep_in_il pass in il_walk.c sets this bit on all entries that are needed for device compilation. See Device/Host Separation and keep-in-il for details.

Sub-Kind Systems

Most primary IL entry kinds use a secondary kind byte to discriminate between variants. These sub-kind enums are the core classification taxonomy of the IL.

Type Kinds (tk_*)

The type kind byte lives at offset +132 in the type node body. 22 values, dispatched by set_type_kind (sub_5E2E80) and displayed by display_type (sub_5F06B0):

The display function references off_A6FE40 (22 string entries) for type kind names. The typeref sub-kind table at off_A6F640 has 28 entries covering typedef aliases, decltype expressions, auto, and concept-constrained placeholders.

Constant Kinds (ck_*)

The constant kind byte lives at offset +148 in the constant node. 16 values, dispatched by display_constant (sub_5F2720):

Address constant sub-kinds (abk_*): abk_routine, abk_variable, abk_constant, abk_temporary, abk_uuidof, abk_typeid, abk_label.

Template parameter constant sub-kinds (tpck_*): tpck_param, tpck_expression, tpck_member, tpck_unknown_function, tpck_address, tpck_sizeof, tpck_datasizeof, tpck_alignof, tpck_uuidof, tpck_typeid, tpck_noexcept, tpck_template_ref, tpck_integer_pack, tpck_destructor.

Expression Node Kinds (enk_*)

The expression kind byte lives at offset +24 in the expression node. 36 values, dispatched by display_expr_node (sub_5ECFE0):

The enk_operation kind (value 1) carries an additional operation.kind byte dispatched through off_A6F840 (120 entries, the eok_* enum) and an operation.type_kind byte from off_A6FE40 (22 entries).

Expression Operation Kinds (eok_*)

The 120+ operation kinds cover all C++ operators. Key groups:

Statement Kinds (stmk_*)

The statement kind byte lives at offset +32 in the statement node. 26 values:

The coroutine statement (kind 9) carries the largest supplement at 128 bytes, containing traits, handle, promise, initial/final suspend calls, unhandled_exception call, get_return_object call, new/delete routines, and parameter copies. A preserved typo in the EDG source reads "paramter_copies" (missing 'e'), confirming genuine EDG lineage.

Scope Kinds (sck_*)

The scope kind byte lives at offset +28 in the scope node. 9 observed values:

Scope kinds determine which child lists are displayed. The bitmask (1 << kind) & 0x20044 (bits 2, 6, 17 = block, class/struct/union, function) and (1 << kind) & 0x9 (bits 0, 3 = file, namespace) control whether namespaces, using_declarations, and using_directives lists appear.

Dynamic Init Kinds (dik_*)

The dynamic init kind byte lives at offset +48. 9 values:

Common IL Node Header

All primary IL node types (type, variable, field, routine, scope, namespace, template, etc.) share a 96-byte common header copied from a template at xmmword_126F6A0..126F6F0. This header is initialized by init_il_alloc (sub_5EAD80) and contains:

• Source correspondence (source_corresp) block: name, position, parent scope, access specifier, linkage, flags
• The display function display_source_corresp (sub_5EDF40) prints these fields for every entity type

Key source correspondence fields (printed for all entities):

• name and unmangled_name_or_mangled_encoding
• decl_position (line + column)
• name_references list
• is_class_member + access (from off_A6F760: public/protected/private/none)
• parent_scope and enclosing_routine
• name_linkage (from off_E6E040: none/internal/external/C/C++)
• Flags: referenced, needed, is_local_to_function, marked_as_gnu_extension, externalized, maybe_unused, is_deprecated_or_unavailable

Initialization and Reset

The IL subsystem initializes in two phases:

One-Time Init (sub_5CF7F0)

Called once at program startup. Validates 7 name-table arrays end with "last" sentinels:

Also validates unsigned_int_kind_of table (byte_E6D1AD == 111 == 'o') and initializes 60+ allocation pools via sub_7A3C00 (pool_init) with element sizes ranging from 1 to 1344 bytes.

Per-TU Init (sub_5CFE20)

Called at the start of each translation unit compilation. Zeroes all pool heads, allocates the constant-sharing hash table (16,312 bytes = 2,039 buckets at qword_126F228), and the character-type hash table (3,240 bytes at qword_126F2F8). Sets sharing mode flags (byte_126E558..126E55A = 3). Tail-calls sub_5EAF00 to reset float constant caches.

Secondary Pool Reset (sub_5D0170)

Resets ~80 transient globals in the 126F680..126F978 range between template instantiation passes. Pure state zeroing, no allocation.

Constant Sharing

IL constants are deduplicated via a 2,039-bucket hash table at qword_126F228. The alloc_shareable_constant function (sub_5D2390) checks constant_is_shareable (sub_5D2210) -- which excludes aggregate constants (kind 10), template parameter constants (kind 12), and string literals when string sharing is disabled (dword_126E1C0).

On a cache hit, the existing constant is relinked to the front of its bucket chain. On a miss, a new 184-byte constant is allocated and inserted. Statistics are tracked: total allocations (qword_126F208), comparisons (qword_126F200), region hits (qword_126F218), global hits (qword_126F220), and new buckets (qword_126F210).

CUDA Extensions to IL

NVIDIA adds several CUDA-specific fields to standard EDG IL nodes:

• Routine flags (bytes 182-183): nvvm_intrinsic, global (global), device (device), host (host)
• Variable flags: shared (shared), constant (constant), device (device), managed (managed)
• keep_in_il bit (prefix byte bit 7): The mechanism for device/host code separation
• Lambda entries (kinds 0x46, 0x47): Extended lambda wrapper support

These extensions are what make cudafe++ the CUDA-aware C++ frontend rather than a stock EDG compiler.

Function Map

Cross-References

• IL Allocation -- Arena allocator details, node sizes, free lists
• IL Walking -- Tree traversal framework with 5 callback slots
• keep-in-il -- Device code selection via bit 7
• IL Display -- Debug dump format and output
• IL Comparison & Copy -- Expression/constant comparison and deep copy
• Device/Host Separation -- CUDA IL marking
• Type System -- 22 type kinds in detail