Skip to content
STIMSMITH

LLVM

Tool WIKI v1 · 7/28/2026

LLVM is a collection of modular and reusable compiler and toolchain technologies, hosted in the llvm/llvm-project repository. It provides intermediate representations, optimizers, code generators, and a family of sub-tools (such as Clang and llvm-cov) used across software development, testing, and verification workflows. LLVM also supplies compiler-based instrumentation hooks (sanitizer coverage) that external systems such as the Linux kernel's KCOV rely on to insert coverage instrumentation, and its toolchain is used to compile C++ co-simulations for hardware/software verification.

LLVM

Overview

The LLVM Project is a collection of modular and reusable compiler and toolchain technologies. It is developed in the open at the llvm/llvm-project repository, which is primarily implemented in the LLVM language and is widely used as the basis for compilers, optimizers, runtimes, and developer tooling [github].

Project scope and ecosystem

The llvm/llvm-project repository hosts the umbrella project that bundles together LLVM's core components (intermediate representation, optimizers, code generators, target backends) along with sub-projects that build on top of them [github].

  • Clang — an LLVM-based C/C++/Objective-C compiler frontend that is distributed as part of llvm/llvm-project. It is the canonical way users invoke the LLVM toolchain for compiling C-family source code [github].
  • llvm-cov — the LLVM source-based code coverage reporting tool, which is also part of llvm/llvm-project. Coverage reports are described as "Generated by llvm-cov" and reference LLVM's Source-Based Code Coverage documentation for interpreting coverage results [qubit-ltd.github.io].

Repository snapshot

Public metadata for llvm/llvm-project indicates the project is actively maintained:

  • Primary language: LLVM
  • Stars: 39,517
  • Forks: 18,007
  • Last updated: 2026-07-28

[github]

LLVM in coverage-guided fuzzing

LLVM provides sanitizer-coverage instrumentation that downstream tools consume:

  • KCOV (the Linux kernel coverage facility) does not embed its own instrumentation; instead, it relies on the sanitizer coverage features provided by GCC and LLVM to insert coverage hooks. With these compiler-based mechanisms, the compiler determines the instrumentation points and invokes the functions defined by the sanitizer specification. Many of the sanitizer-defined functions are shared between GCC and LLVM [arxiv].
  • When the Linux kernel is built with CONFIG_KCOV, the compiler is invoked with -fsanitize-coverage, accepting either trace-pc (tracing only program-counter addresses) or trace-cmp (additionally tracing values involved in conditional branches). trace-pc is the default coverage instrumentation method in the kernel; CONFIG_KCOV_ENABLE_COMPARISONS enables comparison-data tracing [arxiv].
  • The HeteroFuzz system instruments host programs based on the control flow graph (CFG) extracted using LLVM. Each node in the CFG represents a basic code block and each edge represents a transition between two blocks, analogous to AFL's branch-coverage scheme [fse2021].

LLVM in hardware/software co-simulation and verification

LLVM is also used as the compilation toolchain in research prototypes for processor verification:

  • A symbolic-execution-based RISC-V verification approach combines a transcompiled (verilated) cycle-accurate C++ RTL core with a C++ instruction-set simulator (ISS) and compiles them — together with the co-simulation main — into bytecode using the LLVM toolchain to produce a processor co-simulation. The resulting co-simulation is then executed by the symbolic execution engine KLEE to generate test vectors and build a high-coverage test set [uni-bremen].

Related entities

  • Clang — a frontend compiler distributed as part of llvm/llvm-project (PART_OF).
  • llvm-cov — LLVM's source-based code coverage reporting tool, distributed as part of llvm/llvm-project (PART_OF).

Sources

  • GitHub repository llvm/llvm-project [github]
  • Coverage report generated by llvm-cov -- llvm version 21.1.8-rust-1.94.0-stable [qubit-ltd.github.io]
  • Background discussion of KCOV's reliance on LLVM sanitizer coverage [arxiv]
  • HeteroFuzz instrumentation using LLVM [fse2021]
  • RISC-V processor verification using the LLVM toolchain [uni-bremen]

LINKED ENTITIES

2 links
llvm-cov PART_OF
Clang PART_OF

CITATIONS

7 sources
7 citations
[1] The LLVM Project is a collection of modular and reusable compiler and toolchain technologies, hosted in the llvm/llvm-project repository. llvm/llvm-project
[2] llvm/llvm-project is primarily written in the LLVM language, has 39,517 stars, 18,007 forks, and was last updated on 2026-07-28. llvm/llvm-project
[3] Coverage reports are generated by llvm-cov and reference LLVM's Source-Based Code Coverage documentation; one observed report was generated by llvm-cov with llvm version 21.1.8-rust-1.94.0-stable. rs-state-machine coverage report
[4] KCOV relies on the sanitizer coverage features provided by GCC and LLVM to insert coverage hooks, with many sanitizer-defined functions shared between GCC and LLVM. Background and Limitations of Coverage-Guided Fuzzing
[5] With CONFIG_KCOV enabled, the compiler is invoked with -fsanitize-coverage, accepting trace-pc (default) or trace-cmp; CONFIG_KCOV_ENABLE_COMPARISONS enables comparison-data tracing. Background and Limitations of Coverage-Guided Fuzzing
[6] HeteroFuzz instruments host programs based on the control flow graph (CFG) extracted using LLVM, where CFG nodes represent basic code blocks and edges represent transitions between blocks. HeteroFuzz: Fuzz Testing to Detect Platform Dependent Divergence for Heterogeneous Applications
[7] A RISC-V symbolic-execution verification approach combines a verilated C++ RTL core with a C++ ISS and compiles them — together with the co-simulation main — into bytecode using the LLVM toolchain to create the processor co-simulation. Processor Verification using Symbolic Execution: A RISC-V ...