1 //===- GlobalsModRef.cpp - Simple Mod/Ref Analysis for Globals ------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This simple pass provides alias and mod/ref information for global values
11 // that do not have their address taken, and keeps track of whether functions
12 // read or write memory (are "pure"). For this simple (but very common) case,
13 // we can provide pretty accurate and useful information.
15 //===----------------------------------------------------------------------===//
17 #define DEBUG_TYPE "globalsmodref-aa"
18 #include "llvm/Analysis/Passes.h"
19 #include "llvm/Module.h"
20 #include "llvm/Pass.h"
21 #include "llvm/Instructions.h"
22 #include "llvm/Constants.h"
23 #include "llvm/DerivedTypes.h"
24 #include "llvm/Analysis/AliasAnalysis.h"
25 #include "llvm/Analysis/CallGraph.h"
26 #include "llvm/Analysis/MallocHelper.h"
27 #include "llvm/Support/CommandLine.h"
28 #include "llvm/Support/InstIterator.h"
29 #include "llvm/ADT/Statistic.h"
30 #include "llvm/ADT/SCCIterator.h"
34 STATISTIC(NumNonAddrTakenGlobalVars,
35 "Number of global vars without address taken");
36 STATISTIC(NumNonAddrTakenFunctions,"Number of functions without address taken");
37 STATISTIC(NumNoMemFunctions, "Number of functions that do not access memory");
38 STATISTIC(NumReadMemFunctions, "Number of functions that only read memory");
39 STATISTIC(NumIndirectGlobalVars, "Number of indirect global objects");
42 /// FunctionRecord - One instance of this structure is stored for every
43 /// function in the program. Later, the entries for these functions are
44 /// removed if the function is found to call an external function (in which
45 /// case we know nothing about it.
46 struct FunctionRecord {
47 /// GlobalInfo - Maintain mod/ref info for all of the globals without
48 /// addresses taken that are read or written (transitively) by this
50 std::map<GlobalValue*, unsigned> GlobalInfo;
52 /// MayReadAnyGlobal - May read global variables, but it is not known which.
53 bool MayReadAnyGlobal;
55 unsigned getInfoForGlobal(GlobalValue *GV) const {
56 unsigned Effect = MayReadAnyGlobal ? AliasAnalysis::Ref : 0;
57 std::map<GlobalValue*, unsigned>::const_iterator I = GlobalInfo.find(GV);
58 if (I != GlobalInfo.end())
63 /// FunctionEffect - Capture whether or not this function reads or writes to
64 /// ANY memory. If not, we can do a lot of aggressive analysis on it.
65 unsigned FunctionEffect;
67 FunctionRecord() : MayReadAnyGlobal (false), FunctionEffect(0) {}
70 /// GlobalsModRef - The actual analysis pass.
71 class GlobalsModRef : public ModulePass, public AliasAnalysis {
72 /// NonAddressTakenGlobals - The globals that do not have their addresses
74 std::set<GlobalValue*> NonAddressTakenGlobals;
76 /// IndirectGlobals - The memory pointed to by this global is known to be
77 /// 'owned' by the global.
78 std::set<GlobalValue*> IndirectGlobals;
80 /// AllocsForIndirectGlobals - If an instruction allocates memory for an
81 /// indirect global, this map indicates which one.
82 std::map<Value*, GlobalValue*> AllocsForIndirectGlobals;
84 /// FunctionInfo - For each function, keep track of what globals are
86 std::map<Function*, FunctionRecord> FunctionInfo;
90 GlobalsModRef() : ModulePass(&ID) {}
92 bool runOnModule(Module &M) {
93 InitializeAliasAnalysis(this); // set up super class
94 AnalyzeGlobals(M); // find non-addr taken globals
95 AnalyzeCallGraph(getAnalysis<CallGraph>(), M); // Propagate on CG
99 virtual void getAnalysisUsage(AnalysisUsage &AU) const {
100 AliasAnalysis::getAnalysisUsage(AU);
101 AU.addRequired<CallGraph>();
102 AU.setPreservesAll(); // Does not transform code
105 //------------------------------------------------
106 // Implement the AliasAnalysis API
108 AliasResult alias(const Value *V1, unsigned V1Size,
109 const Value *V2, unsigned V2Size);
110 ModRefResult getModRefInfo(CallSite CS, Value *P, unsigned Size);
111 ModRefResult getModRefInfo(CallSite CS1, CallSite CS2) {
112 return AliasAnalysis::getModRefInfo(CS1,CS2);
114 bool hasNoModRefInfoForCalls() const { return false; }
116 /// getModRefBehavior - Return the behavior of the specified function if
117 /// called from the specified call site. The call site may be null in which
118 /// case the most generic behavior of this function should be returned.
119 ModRefBehavior getModRefBehavior(Function *F,
120 std::vector<PointerAccessInfo> *Info) {
121 if (FunctionRecord *FR = getFunctionInfo(F)) {
122 if (FR->FunctionEffect == 0)
123 return DoesNotAccessMemory;
124 else if ((FR->FunctionEffect & Mod) == 0)
125 return OnlyReadsMemory;
127 return AliasAnalysis::getModRefBehavior(F, Info);
130 /// getModRefBehavior - Return the behavior of the specified function if
131 /// called from the specified call site. The call site may be null in which
132 /// case the most generic behavior of this function should be returned.
133 ModRefBehavior getModRefBehavior(CallSite CS,
134 std::vector<PointerAccessInfo> *Info) {
135 Function* F = CS.getCalledFunction();
136 if (!F) return AliasAnalysis::getModRefBehavior(CS, Info);
137 if (FunctionRecord *FR = getFunctionInfo(F)) {
138 if (FR->FunctionEffect == 0)
139 return DoesNotAccessMemory;
140 else if ((FR->FunctionEffect & Mod) == 0)
141 return OnlyReadsMemory;
143 return AliasAnalysis::getModRefBehavior(CS, Info);
146 virtual void deleteValue(Value *V);
147 virtual void copyValue(Value *From, Value *To);
150 /// getFunctionInfo - Return the function info for the function, or null if
151 /// we don't have anything useful to say about it.
152 FunctionRecord *getFunctionInfo(Function *F) {
153 std::map<Function*, FunctionRecord>::iterator I = FunctionInfo.find(F);
154 if (I != FunctionInfo.end())
159 void AnalyzeGlobals(Module &M);
160 void AnalyzeCallGraph(CallGraph &CG, Module &M);
161 bool AnalyzeUsesOfPointer(Value *V, std::vector<Function*> &Readers,
162 std::vector<Function*> &Writers,
163 GlobalValue *OkayStoreDest = 0);
164 bool AnalyzeIndirectGlobalMemory(GlobalValue *GV);
168 char GlobalsModRef::ID = 0;
169 static RegisterPass<GlobalsModRef>
170 X("globalsmodref-aa", "Simple mod/ref analysis for globals", false, true);
171 static RegisterAnalysisGroup<AliasAnalysis> Y(X);
173 Pass *llvm::createGlobalsModRefPass() { return new GlobalsModRef(); }
175 /// AnalyzeGlobals - Scan through the users of all of the internal
176 /// GlobalValue's in the program. If none of them have their "address taken"
177 /// (really, their address passed to something nontrivial), record this fact,
178 /// and record the functions that they are used directly in.
179 void GlobalsModRef::AnalyzeGlobals(Module &M) {
180 std::vector<Function*> Readers, Writers;
181 for (Module::iterator I = M.begin(), E = M.end(); I != E; ++I)
182 if (I->hasLocalLinkage()) {
183 if (!AnalyzeUsesOfPointer(I, Readers, Writers)) {
184 // Remember that we are tracking this global.
185 NonAddressTakenGlobals.insert(I);
186 ++NumNonAddrTakenFunctions;
188 Readers.clear(); Writers.clear();
191 for (Module::global_iterator I = M.global_begin(), E = M.global_end();
193 if (I->hasLocalLinkage()) {
194 if (!AnalyzeUsesOfPointer(I, Readers, Writers)) {
195 // Remember that we are tracking this global, and the mod/ref fns
196 NonAddressTakenGlobals.insert(I);
198 for (unsigned i = 0, e = Readers.size(); i != e; ++i)
199 FunctionInfo[Readers[i]].GlobalInfo[I] |= Ref;
201 if (!I->isConstant()) // No need to keep track of writers to constants
202 for (unsigned i = 0, e = Writers.size(); i != e; ++i)
203 FunctionInfo[Writers[i]].GlobalInfo[I] |= Mod;
204 ++NumNonAddrTakenGlobalVars;
206 // If this global holds a pointer type, see if it is an indirect global.
207 if (isa<PointerType>(I->getType()->getElementType()) &&
208 AnalyzeIndirectGlobalMemory(I))
209 ++NumIndirectGlobalVars;
211 Readers.clear(); Writers.clear();
215 /// AnalyzeUsesOfPointer - Look at all of the users of the specified pointer.
216 /// If this is used by anything complex (i.e., the address escapes), return
217 /// true. Also, while we are at it, keep track of those functions that read and
218 /// write to the value.
220 /// If OkayStoreDest is non-null, stores into this global are allowed.
221 bool GlobalsModRef::AnalyzeUsesOfPointer(Value *V,
222 std::vector<Function*> &Readers,
223 std::vector<Function*> &Writers,
224 GlobalValue *OkayStoreDest) {
225 if (!isa<PointerType>(V->getType())) return true;
227 for (Value::use_iterator UI = V->use_begin(), E = V->use_end(); UI != E; ++UI)
228 if (LoadInst *LI = dyn_cast<LoadInst>(*UI)) {
229 Readers.push_back(LI->getParent()->getParent());
230 } else if (StoreInst *SI = dyn_cast<StoreInst>(*UI)) {
231 if (V == SI->getOperand(1)) {
232 Writers.push_back(SI->getParent()->getParent());
233 } else if (SI->getOperand(1) != OkayStoreDest) {
234 return true; // Storing the pointer
236 } else if (GetElementPtrInst *GEP = dyn_cast<GetElementPtrInst>(*UI)) {
237 if (AnalyzeUsesOfPointer(GEP, Readers, Writers)) return true;
238 } else if (BitCastInst *BCI = dyn_cast<BitCastInst>(*UI)) {
239 if (AnalyzeUsesOfPointer(BCI, Readers, Writers, OkayStoreDest))
241 } else if (isa<FreeInst>(*UI) || isFreeCall(*UI)) {
242 Writers.push_back(cast<Instruction>(*UI)->getParent()->getParent());
243 } else if (CallInst *CI = dyn_cast<CallInst>(*UI)) {
244 // Make sure that this is just the function being called, not that it is
245 // passing into the function.
246 for (unsigned i = 1, e = CI->getNumOperands(); i != e; ++i)
247 if (CI->getOperand(i) == V) return true;
248 } else if (InvokeInst *II = dyn_cast<InvokeInst>(*UI)) {
249 // Make sure that this is just the function being called, not that it is
250 // passing into the function.
251 for (unsigned i = 3, e = II->getNumOperands(); i != e; ++i)
252 if (II->getOperand(i) == V) return true;
253 } else if (ConstantExpr *CE = dyn_cast<ConstantExpr>(*UI)) {
254 if (CE->getOpcode() == Instruction::GetElementPtr ||
255 CE->getOpcode() == Instruction::BitCast) {
256 if (AnalyzeUsesOfPointer(CE, Readers, Writers))
261 } else if (ICmpInst *ICI = dyn_cast<ICmpInst>(*UI)) {
262 if (!isa<ConstantPointerNull>(ICI->getOperand(1)))
263 return true; // Allow comparison against null.
270 /// AnalyzeIndirectGlobalMemory - We found an non-address-taken global variable
271 /// which holds a pointer type. See if the global always points to non-aliased
272 /// heap memory: that is, all initializers of the globals are allocations, and
273 /// those allocations have no use other than initialization of the global.
274 /// Further, all loads out of GV must directly use the memory, not store the
275 /// pointer somewhere. If this is true, we consider the memory pointed to by
276 /// GV to be owned by GV and can disambiguate other pointers from it.
277 bool GlobalsModRef::AnalyzeIndirectGlobalMemory(GlobalValue *GV) {
278 // Keep track of values related to the allocation of the memory, f.e. the
279 // value produced by the malloc call and any casts.
280 std::vector<Value*> AllocRelatedValues;
282 // Walk the user list of the global. If we find anything other than a direct
283 // load or store, bail out.
284 for (Value::use_iterator I = GV->use_begin(), E = GV->use_end(); I != E; ++I){
285 if (LoadInst *LI = dyn_cast<LoadInst>(*I)) {
286 // The pointer loaded from the global can only be used in simple ways:
287 // we allow addressing of it and loading storing to it. We do *not* allow
288 // storing the loaded pointer somewhere else or passing to a function.
289 std::vector<Function*> ReadersWriters;
290 if (AnalyzeUsesOfPointer(LI, ReadersWriters, ReadersWriters))
291 return false; // Loaded pointer escapes.
292 // TODO: Could try some IP mod/ref of the loaded pointer.
293 } else if (StoreInst *SI = dyn_cast<StoreInst>(*I)) {
294 // Storing the global itself.
295 if (SI->getOperand(0) == GV) return false;
297 // If storing the null pointer, ignore it.
298 if (isa<ConstantPointerNull>(SI->getOperand(0)))
301 // Check the value being stored.
302 Value *Ptr = SI->getOperand(0)->getUnderlyingObject();
306 } else if (CallInst *CI = dyn_cast<CallInst>(Ptr)) {
307 Function *F = CI->getCalledFunction();
308 if (!F || !F->isDeclaration()) return false; // Too hard to analyze.
309 if (F->getName() != "calloc") return false; // Not calloc.
311 return false; // Too hard to analyze.
314 // Analyze all uses of the allocation. If any of them are used in a
315 // non-simple way (e.g. stored to another global) bail out.
316 std::vector<Function*> ReadersWriters;
317 if (AnalyzeUsesOfPointer(Ptr, ReadersWriters, ReadersWriters, GV))
318 return false; // Loaded pointer escapes.
320 // Remember that this allocation is related to the indirect global.
321 AllocRelatedValues.push_back(Ptr);
323 // Something complex, bail out.
328 // Okay, this is an indirect global. Remember all of the allocations for
329 // this global in AllocsForIndirectGlobals.
330 while (!AllocRelatedValues.empty()) {
331 AllocsForIndirectGlobals[AllocRelatedValues.back()] = GV;
332 AllocRelatedValues.pop_back();
334 IndirectGlobals.insert(GV);
338 /// AnalyzeCallGraph - At this point, we know the functions where globals are
339 /// immediately stored to and read from. Propagate this information up the call
340 /// graph to all callers and compute the mod/ref info for all memory for each
342 void GlobalsModRef::AnalyzeCallGraph(CallGraph &CG, Module &M) {
343 // We do a bottom-up SCC traversal of the call graph. In other words, we
344 // visit all callees before callers (leaf-first).
345 for (scc_iterator<CallGraph*> I = scc_begin(&CG), E = scc_end(&CG); I != E;
347 std::vector<CallGraphNode *> &SCC = *I;
348 assert(!SCC.empty() && "SCC with no functions?");
350 if (!SCC[0]->getFunction()) {
351 // Calls externally - can't say anything useful. Remove any existing
352 // function records (may have been created when scanning globals).
353 for (unsigned i = 0, e = SCC.size(); i != e; ++i)
354 FunctionInfo.erase(SCC[i]->getFunction());
358 FunctionRecord &FR = FunctionInfo[SCC[0]->getFunction()];
360 bool KnowNothing = false;
361 unsigned FunctionEffect = 0;
363 // Collect the mod/ref properties due to called functions. We only compute
365 for (unsigned i = 0, e = SCC.size(); i != e && !KnowNothing; ++i) {
366 Function *F = SCC[i]->getFunction();
372 if (F->isDeclaration()) {
373 // Try to get mod/ref behaviour from function attributes.
374 if (F->doesNotAccessMemory()) {
375 // Can't do better than that!
376 } else if (F->onlyReadsMemory()) {
377 FunctionEffect |= Ref;
378 if (!F->isIntrinsic())
379 // This function might call back into the module and read a global -
380 // consider every global as possibly being read by this function.
381 FR.MayReadAnyGlobal = true;
383 FunctionEffect |= ModRef;
384 // Can't say anything useful unless it's an intrinsic - they don't
385 // read or write global variables of the kind considered here.
386 KnowNothing = !F->isIntrinsic();
391 for (CallGraphNode::iterator CI = SCC[i]->begin(), E = SCC[i]->end();
392 CI != E && !KnowNothing; ++CI)
393 if (Function *Callee = CI->second->getFunction()) {
394 if (FunctionRecord *CalleeFR = getFunctionInfo(Callee)) {
395 // Propagate function effect up.
396 FunctionEffect |= CalleeFR->FunctionEffect;
398 // Incorporate callee's effects on globals into our info.
399 for (std::map<GlobalValue*, unsigned>::iterator GI =
400 CalleeFR->GlobalInfo.begin(), E = CalleeFR->GlobalInfo.end();
402 FR.GlobalInfo[GI->first] |= GI->second;
403 FR.MayReadAnyGlobal |= CalleeFR->MayReadAnyGlobal;
405 // Can't say anything about it. However, if it is inside our SCC,
406 // then nothing needs to be done.
407 CallGraphNode *CalleeNode = CG[Callee];
408 if (std::find(SCC.begin(), SCC.end(), CalleeNode) == SCC.end())
416 // If we can't say anything useful about this SCC, remove all SCC functions
417 // from the FunctionInfo map.
419 for (unsigned i = 0, e = SCC.size(); i != e; ++i)
420 FunctionInfo.erase(SCC[i]->getFunction());
424 // Scan the function bodies for explicit loads or stores.
425 for (unsigned i = 0, e = SCC.size(); i != e && FunctionEffect != ModRef;++i)
426 for (inst_iterator II = inst_begin(SCC[i]->getFunction()),
427 E = inst_end(SCC[i]->getFunction());
428 II != E && FunctionEffect != ModRef; ++II)
429 if (isa<LoadInst>(*II)) {
430 FunctionEffect |= Ref;
431 if (cast<LoadInst>(*II).isVolatile())
432 // Volatile loads may have side-effects, so mark them as writing
433 // memory (for example, a flag inside the processor).
434 FunctionEffect |= Mod;
435 } else if (isa<StoreInst>(*II)) {
436 FunctionEffect |= Mod;
437 if (cast<StoreInst>(*II).isVolatile())
438 // Treat volatile stores as reading memory somewhere.
439 FunctionEffect |= Ref;
440 } else if (isMalloc(&cast<Instruction>(*II)) || isa<FreeInst>(*II) ||
441 isFreeCall(&cast<Instruction>(*II))) {
442 FunctionEffect |= ModRef;
445 if ((FunctionEffect & Mod) == 0)
446 ++NumReadMemFunctions;
447 if (FunctionEffect == 0)
449 FR.FunctionEffect = FunctionEffect;
451 // Finally, now that we know the full effect on this SCC, clone the
452 // information to each function in the SCC.
453 for (unsigned i = 1, e = SCC.size(); i != e; ++i)
454 FunctionInfo[SCC[i]->getFunction()] = FR;
460 /// alias - If one of the pointers is to a global that we are tracking, and the
461 /// other is some random pointer, we know there cannot be an alias, because the
462 /// address of the global isn't taken.
463 AliasAnalysis::AliasResult
464 GlobalsModRef::alias(const Value *V1, unsigned V1Size,
465 const Value *V2, unsigned V2Size) {
466 // Get the base object these pointers point to.
467 Value *UV1 = const_cast<Value*>(V1->getUnderlyingObject());
468 Value *UV2 = const_cast<Value*>(V2->getUnderlyingObject());
470 // If either of the underlying values is a global, they may be non-addr-taken
471 // globals, which we can answer queries about.
472 GlobalValue *GV1 = dyn_cast<GlobalValue>(UV1);
473 GlobalValue *GV2 = dyn_cast<GlobalValue>(UV2);
475 // If the global's address is taken, pretend we don't know it's a pointer to
477 if (GV1 && !NonAddressTakenGlobals.count(GV1)) GV1 = 0;
478 if (GV2 && !NonAddressTakenGlobals.count(GV2)) GV2 = 0;
480 // If the the two pointers are derived from two different non-addr-taken
481 // globals, or if one is and the other isn't, we know these can't alias.
482 if ((GV1 || GV2) && GV1 != GV2)
485 // Otherwise if they are both derived from the same addr-taken global, we
486 // can't know the two accesses don't overlap.
489 // These pointers may be based on the memory owned by an indirect global. If
490 // so, we may be able to handle this. First check to see if the base pointer
491 // is a direct load from an indirect global.
493 if (LoadInst *LI = dyn_cast<LoadInst>(UV1))
494 if (GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0)))
495 if (IndirectGlobals.count(GV))
497 if (LoadInst *LI = dyn_cast<LoadInst>(UV2))
498 if (GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0)))
499 if (IndirectGlobals.count(GV))
502 // These pointers may also be from an allocation for the indirect global. If
503 // so, also handle them.
504 if (AllocsForIndirectGlobals.count(UV1))
505 GV1 = AllocsForIndirectGlobals[UV1];
506 if (AllocsForIndirectGlobals.count(UV2))
507 GV2 = AllocsForIndirectGlobals[UV2];
509 // Now that we know whether the two pointers are related to indirect globals,
510 // use this to disambiguate the pointers. If either pointer is based on an
511 // indirect global and if they are not both based on the same indirect global,
512 // they cannot alias.
513 if ((GV1 || GV2) && GV1 != GV2)
516 return AliasAnalysis::alias(V1, V1Size, V2, V2Size);
519 AliasAnalysis::ModRefResult
520 GlobalsModRef::getModRefInfo(CallSite CS, Value *P, unsigned Size) {
521 unsigned Known = ModRef;
523 // If we are asking for mod/ref info of a direct call with a pointer to a
524 // global we are tracking, return information if we have it.
525 if (GlobalValue *GV = dyn_cast<GlobalValue>(P->getUnderlyingObject()))
526 if (GV->hasLocalLinkage())
527 if (Function *F = CS.getCalledFunction())
528 if (NonAddressTakenGlobals.count(GV))
529 if (FunctionRecord *FR = getFunctionInfo(F))
530 Known = FR->getInfoForGlobal(GV);
532 if (Known == NoModRef)
533 return NoModRef; // No need to query other mod/ref analyses
534 return ModRefResult(Known & AliasAnalysis::getModRefInfo(CS, P, Size));
538 //===----------------------------------------------------------------------===//
539 // Methods to update the analysis as a result of the client transformation.
541 void GlobalsModRef::deleteValue(Value *V) {
542 if (GlobalValue *GV = dyn_cast<GlobalValue>(V)) {
543 if (NonAddressTakenGlobals.erase(GV)) {
544 // This global might be an indirect global. If so, remove it and remove
545 // any AllocRelatedValues for it.
546 if (IndirectGlobals.erase(GV)) {
547 // Remove any entries in AllocsForIndirectGlobals for this global.
548 for (std::map<Value*, GlobalValue*>::iterator
549 I = AllocsForIndirectGlobals.begin(),
550 E = AllocsForIndirectGlobals.end(); I != E; ) {
551 if (I->second == GV) {
552 AllocsForIndirectGlobals.erase(I++);
561 // Otherwise, if this is an allocation related to an indirect global, remove
563 AllocsForIndirectGlobals.erase(V);
565 AliasAnalysis::deleteValue(V);
568 void GlobalsModRef::copyValue(Value *From, Value *To) {
569 AliasAnalysis::copyValue(From, To);