1 //===- GlobalsModRef.cpp - Simple Mod/Ref Analysis for Globals ------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This simple pass provides alias and mod/ref information for global values
11 // that do not have their address taken, and keeps track of whether functions
12 // read or write memory (are "pure"). For this simple (but very common) case,
13 // we can provide pretty accurate and useful information.
15 //===----------------------------------------------------------------------===//
17 #define DEBUG_TYPE "globalsmodref-aa"
18 #include "llvm/Analysis/Passes.h"
19 #include "llvm/Module.h"
20 #include "llvm/Pass.h"
21 #include "llvm/Instructions.h"
22 #include "llvm/Constants.h"
23 #include "llvm/DerivedTypes.h"
24 #include "llvm/Analysis/AliasAnalysis.h"
25 #include "llvm/Analysis/CallGraph.h"
26 #include "llvm/Analysis/MemoryBuiltins.h"
27 #include "llvm/Analysis/ValueTracking.h"
28 #include "llvm/Support/CommandLine.h"
29 #include "llvm/Support/InstIterator.h"
30 #include "llvm/ADT/Statistic.h"
31 #include "llvm/ADT/SCCIterator.h"
35 STATISTIC(NumNonAddrTakenGlobalVars,
36 "Number of global vars without address taken");
37 STATISTIC(NumNonAddrTakenFunctions,"Number of functions without address taken");
38 STATISTIC(NumNoMemFunctions, "Number of functions that do not access memory");
39 STATISTIC(NumReadMemFunctions, "Number of functions that only read memory");
40 STATISTIC(NumIndirectGlobalVars, "Number of indirect global objects");
43 /// FunctionRecord - One instance of this structure is stored for every
44 /// function in the program. Later, the entries for these functions are
45 /// removed if the function is found to call an external function (in which
46 /// case we know nothing about it.
47 struct FunctionRecord {
48 /// GlobalInfo - Maintain mod/ref info for all of the globals without
49 /// addresses taken that are read or written (transitively) by this
51 std::map<const GlobalValue*, unsigned> GlobalInfo;
53 /// MayReadAnyGlobal - May read global variables, but it is not known which.
54 bool MayReadAnyGlobal;
56 unsigned getInfoForGlobal(const GlobalValue *GV) const {
57 unsigned Effect = MayReadAnyGlobal ? AliasAnalysis::Ref : 0;
58 std::map<const GlobalValue*, unsigned>::const_iterator I =
60 if (I != GlobalInfo.end())
65 /// FunctionEffect - Capture whether or not this function reads or writes to
66 /// ANY memory. If not, we can do a lot of aggressive analysis on it.
67 unsigned FunctionEffect;
69 FunctionRecord() : MayReadAnyGlobal (false), FunctionEffect(0) {}
72 /// GlobalsModRef - The actual analysis pass.
73 class GlobalsModRef : public ModulePass, public AliasAnalysis {
74 /// NonAddressTakenGlobals - The globals that do not have their addresses
76 std::set<const GlobalValue*> NonAddressTakenGlobals;
78 /// IndirectGlobals - The memory pointed to by this global is known to be
79 /// 'owned' by the global.
80 std::set<const GlobalValue*> IndirectGlobals;
82 /// AllocsForIndirectGlobals - If an instruction allocates memory for an
83 /// indirect global, this map indicates which one.
84 std::map<const Value*, const GlobalValue*> AllocsForIndirectGlobals;
86 /// FunctionInfo - For each function, keep track of what globals are
88 std::map<const Function*, FunctionRecord> FunctionInfo;
92 GlobalsModRef() : ModulePass(ID) {
93 initializeGlobalsModRefPass(*PassRegistry::getPassRegistry());
96 bool runOnModule(Module &M) {
97 InitializeAliasAnalysis(this); // set up super class
98 AnalyzeGlobals(M); // find non-addr taken globals
99 AnalyzeCallGraph(getAnalysis<CallGraph>(), M); // Propagate on CG
103 virtual void getAnalysisUsage(AnalysisUsage &AU) const {
104 AliasAnalysis::getAnalysisUsage(AU);
105 AU.addRequired<CallGraph>();
106 AU.setPreservesAll(); // Does not transform code
109 //------------------------------------------------
110 // Implement the AliasAnalysis API
112 AliasResult alias(const Location &LocA, const Location &LocB);
113 ModRefResult getModRefInfo(ImmutableCallSite CS,
114 const Location &Loc);
115 ModRefResult getModRefInfo(ImmutableCallSite CS1,
116 ImmutableCallSite CS2) {
117 return AliasAnalysis::getModRefInfo(CS1, CS2);
120 /// getModRefBehavior - Return the behavior of the specified function if
121 /// called from the specified call site. The call site may be null in which
122 /// case the most generic behavior of this function should be returned.
123 ModRefBehavior getModRefBehavior(const Function *F) {
124 ModRefBehavior Min = UnknownModRefBehavior;
126 if (FunctionRecord *FR = getFunctionInfo(F)) {
127 if (FR->FunctionEffect == 0)
128 Min = DoesNotAccessMemory;
129 else if ((FR->FunctionEffect & Mod) == 0)
130 Min = OnlyReadsMemory;
133 return ModRefBehavior(AliasAnalysis::getModRefBehavior(F) & Min);
136 /// getModRefBehavior - Return the behavior of the specified function if
137 /// called from the specified call site. The call site may be null in which
138 /// case the most generic behavior of this function should be returned.
139 ModRefBehavior getModRefBehavior(ImmutableCallSite CS) {
140 ModRefBehavior Min = UnknownModRefBehavior;
142 if (const Function* F = CS.getCalledFunction())
143 if (FunctionRecord *FR = getFunctionInfo(F)) {
144 if (FR->FunctionEffect == 0)
145 Min = DoesNotAccessMemory;
146 else if ((FR->FunctionEffect & Mod) == 0)
147 Min = OnlyReadsMemory;
150 return ModRefBehavior(AliasAnalysis::getModRefBehavior(CS) & Min);
153 virtual void deleteValue(Value *V);
154 virtual void copyValue(Value *From, Value *To);
156 /// getAdjustedAnalysisPointer - This method is used when a pass implements
157 /// an analysis interface through multiple inheritance. If needed, it
158 /// should override this to adjust the this pointer as needed for the
159 /// specified pass info.
160 virtual void *getAdjustedAnalysisPointer(AnalysisID PI) {
161 if (PI == &AliasAnalysis::ID)
162 return (AliasAnalysis*)this;
167 /// getFunctionInfo - Return the function info for the function, or null if
168 /// we don't have anything useful to say about it.
169 FunctionRecord *getFunctionInfo(const Function *F) {
170 std::map<const Function*, FunctionRecord>::iterator I =
171 FunctionInfo.find(F);
172 if (I != FunctionInfo.end())
177 void AnalyzeGlobals(Module &M);
178 void AnalyzeCallGraph(CallGraph &CG, Module &M);
179 bool AnalyzeUsesOfPointer(Value *V, std::vector<Function*> &Readers,
180 std::vector<Function*> &Writers,
181 GlobalValue *OkayStoreDest = 0);
182 bool AnalyzeIndirectGlobalMemory(GlobalValue *GV);
186 char GlobalsModRef::ID = 0;
187 INITIALIZE_AG_PASS_BEGIN(GlobalsModRef, AliasAnalysis,
188 "globalsmodref-aa", "Simple mod/ref analysis for globals",
190 INITIALIZE_AG_DEPENDENCY(CallGraph)
191 INITIALIZE_AG_PASS_END(GlobalsModRef, AliasAnalysis,
192 "globalsmodref-aa", "Simple mod/ref analysis for globals",
195 Pass *llvm::createGlobalsModRefPass() { return new GlobalsModRef(); }
197 /// AnalyzeGlobals - Scan through the users of all of the internal
198 /// GlobalValue's in the program. If none of them have their "address taken"
199 /// (really, their address passed to something nontrivial), record this fact,
200 /// and record the functions that they are used directly in.
201 void GlobalsModRef::AnalyzeGlobals(Module &M) {
202 std::vector<Function*> Readers, Writers;
203 for (Module::iterator I = M.begin(), E = M.end(); I != E; ++I)
204 if (I->hasLocalLinkage()) {
205 if (!AnalyzeUsesOfPointer(I, Readers, Writers)) {
206 // Remember that we are tracking this global.
207 NonAddressTakenGlobals.insert(I);
208 ++NumNonAddrTakenFunctions;
210 Readers.clear(); Writers.clear();
213 for (Module::global_iterator I = M.global_begin(), E = M.global_end();
215 if (I->hasLocalLinkage()) {
216 if (!AnalyzeUsesOfPointer(I, Readers, Writers)) {
217 // Remember that we are tracking this global, and the mod/ref fns
218 NonAddressTakenGlobals.insert(I);
220 for (unsigned i = 0, e = Readers.size(); i != e; ++i)
221 FunctionInfo[Readers[i]].GlobalInfo[I] |= Ref;
223 if (!I->isConstant()) // No need to keep track of writers to constants
224 for (unsigned i = 0, e = Writers.size(); i != e; ++i)
225 FunctionInfo[Writers[i]].GlobalInfo[I] |= Mod;
226 ++NumNonAddrTakenGlobalVars;
228 // If this global holds a pointer type, see if it is an indirect global.
229 if (I->getType()->getElementType()->isPointerTy() &&
230 AnalyzeIndirectGlobalMemory(I))
231 ++NumIndirectGlobalVars;
233 Readers.clear(); Writers.clear();
237 /// AnalyzeUsesOfPointer - Look at all of the users of the specified pointer.
238 /// If this is used by anything complex (i.e., the address escapes), return
239 /// true. Also, while we are at it, keep track of those functions that read and
240 /// write to the value.
242 /// If OkayStoreDest is non-null, stores into this global are allowed.
243 bool GlobalsModRef::AnalyzeUsesOfPointer(Value *V,
244 std::vector<Function*> &Readers,
245 std::vector<Function*> &Writers,
246 GlobalValue *OkayStoreDest) {
247 if (!V->getType()->isPointerTy()) return true;
249 for (Value::use_iterator UI = V->use_begin(), E=V->use_end(); UI != E; ++UI) {
251 if (LoadInst *LI = dyn_cast<LoadInst>(U)) {
252 Readers.push_back(LI->getParent()->getParent());
253 } else if (StoreInst *SI = dyn_cast<StoreInst>(U)) {
254 if (V == SI->getOperand(1)) {
255 Writers.push_back(SI->getParent()->getParent());
256 } else if (SI->getOperand(1) != OkayStoreDest) {
257 return true; // Storing the pointer
259 } else if (GetElementPtrInst *GEP = dyn_cast<GetElementPtrInst>(U)) {
260 if (AnalyzeUsesOfPointer(GEP, Readers, Writers)) return true;
261 } else if (BitCastInst *BCI = dyn_cast<BitCastInst>(U)) {
262 if (AnalyzeUsesOfPointer(BCI, Readers, Writers, OkayStoreDest))
264 } else if (isFreeCall(U)) {
265 Writers.push_back(cast<Instruction>(U)->getParent()->getParent());
266 } else if (CallInst *CI = dyn_cast<CallInst>(U)) {
267 // Make sure that this is just the function being called, not that it is
268 // passing into the function.
269 for (unsigned i = 0, e = CI->getNumArgOperands(); i != e; ++i)
270 if (CI->getArgOperand(i) == V) return true;
271 } else if (InvokeInst *II = dyn_cast<InvokeInst>(U)) {
272 // Make sure that this is just the function being called, not that it is
273 // passing into the function.
274 for (unsigned i = 0, e = II->getNumArgOperands(); i != e; ++i)
275 if (II->getArgOperand(i) == V) return true;
276 } else if (ConstantExpr *CE = dyn_cast<ConstantExpr>(U)) {
277 if (CE->getOpcode() == Instruction::GetElementPtr ||
278 CE->getOpcode() == Instruction::BitCast) {
279 if (AnalyzeUsesOfPointer(CE, Readers, Writers))
284 } else if (ICmpInst *ICI = dyn_cast<ICmpInst>(U)) {
285 if (!isa<ConstantPointerNull>(ICI->getOperand(1)))
286 return true; // Allow comparison against null.
295 /// AnalyzeIndirectGlobalMemory - We found an non-address-taken global variable
296 /// which holds a pointer type. See if the global always points to non-aliased
297 /// heap memory: that is, all initializers of the globals are allocations, and
298 /// those allocations have no use other than initialization of the global.
299 /// Further, all loads out of GV must directly use the memory, not store the
300 /// pointer somewhere. If this is true, we consider the memory pointed to by
301 /// GV to be owned by GV and can disambiguate other pointers from it.
302 bool GlobalsModRef::AnalyzeIndirectGlobalMemory(GlobalValue *GV) {
303 // Keep track of values related to the allocation of the memory, f.e. the
304 // value produced by the malloc call and any casts.
305 std::vector<Value*> AllocRelatedValues;
307 // Walk the user list of the global. If we find anything other than a direct
308 // load or store, bail out.
309 for (Value::use_iterator I = GV->use_begin(), E = GV->use_end(); I != E; ++I){
311 if (LoadInst *LI = dyn_cast<LoadInst>(U)) {
312 // The pointer loaded from the global can only be used in simple ways:
313 // we allow addressing of it and loading storing to it. We do *not* allow
314 // storing the loaded pointer somewhere else or passing to a function.
315 std::vector<Function*> ReadersWriters;
316 if (AnalyzeUsesOfPointer(LI, ReadersWriters, ReadersWriters))
317 return false; // Loaded pointer escapes.
318 // TODO: Could try some IP mod/ref of the loaded pointer.
319 } else if (StoreInst *SI = dyn_cast<StoreInst>(U)) {
320 // Storing the global itself.
321 if (SI->getOperand(0) == GV) return false;
323 // If storing the null pointer, ignore it.
324 if (isa<ConstantPointerNull>(SI->getOperand(0)))
327 // Check the value being stored.
328 Value *Ptr = GetUnderlyingObject(SI->getOperand(0));
332 } else if (CallInst *CI = dyn_cast<CallInst>(Ptr)) {
333 Function *F = CI->getCalledFunction();
334 if (!F || !F->isDeclaration()) return false; // Too hard to analyze.
335 if (F->getName() != "calloc") return false; // Not calloc.
337 return false; // Too hard to analyze.
340 // Analyze all uses of the allocation. If any of them are used in a
341 // non-simple way (e.g. stored to another global) bail out.
342 std::vector<Function*> ReadersWriters;
343 if (AnalyzeUsesOfPointer(Ptr, ReadersWriters, ReadersWriters, GV))
344 return false; // Loaded pointer escapes.
346 // Remember that this allocation is related to the indirect global.
347 AllocRelatedValues.push_back(Ptr);
349 // Something complex, bail out.
354 // Okay, this is an indirect global. Remember all of the allocations for
355 // this global in AllocsForIndirectGlobals.
356 while (!AllocRelatedValues.empty()) {
357 AllocsForIndirectGlobals[AllocRelatedValues.back()] = GV;
358 AllocRelatedValues.pop_back();
360 IndirectGlobals.insert(GV);
364 /// AnalyzeCallGraph - At this point, we know the functions where globals are
365 /// immediately stored to and read from. Propagate this information up the call
366 /// graph to all callers and compute the mod/ref info for all memory for each
368 void GlobalsModRef::AnalyzeCallGraph(CallGraph &CG, Module &M) {
369 // We do a bottom-up SCC traversal of the call graph. In other words, we
370 // visit all callees before callers (leaf-first).
371 for (scc_iterator<CallGraph*> I = scc_begin(&CG), E = scc_end(&CG); I != E;
373 std::vector<CallGraphNode *> &SCC = *I;
374 assert(!SCC.empty() && "SCC with no functions?");
376 if (!SCC[0]->getFunction()) {
377 // Calls externally - can't say anything useful. Remove any existing
378 // function records (may have been created when scanning globals).
379 for (unsigned i = 0, e = SCC.size(); i != e; ++i)
380 FunctionInfo.erase(SCC[i]->getFunction());
384 FunctionRecord &FR = FunctionInfo[SCC[0]->getFunction()];
386 bool KnowNothing = false;
387 unsigned FunctionEffect = 0;
389 // Collect the mod/ref properties due to called functions. We only compute
391 for (unsigned i = 0, e = SCC.size(); i != e && !KnowNothing; ++i) {
392 Function *F = SCC[i]->getFunction();
398 if (F->isDeclaration()) {
399 // Try to get mod/ref behaviour from function attributes.
400 if (F->doesNotAccessMemory()) {
401 // Can't do better than that!
402 } else if (F->onlyReadsMemory()) {
403 FunctionEffect |= Ref;
404 if (!F->isIntrinsic())
405 // This function might call back into the module and read a global -
406 // consider every global as possibly being read by this function.
407 FR.MayReadAnyGlobal = true;
409 FunctionEffect |= ModRef;
410 // Can't say anything useful unless it's an intrinsic - they don't
411 // read or write global variables of the kind considered here.
412 KnowNothing = !F->isIntrinsic();
417 for (CallGraphNode::iterator CI = SCC[i]->begin(), E = SCC[i]->end();
418 CI != E && !KnowNothing; ++CI)
419 if (Function *Callee = CI->second->getFunction()) {
420 if (FunctionRecord *CalleeFR = getFunctionInfo(Callee)) {
421 // Propagate function effect up.
422 FunctionEffect |= CalleeFR->FunctionEffect;
424 // Incorporate callee's effects on globals into our info.
425 for (std::map<const GlobalValue*, unsigned>::iterator GI =
426 CalleeFR->GlobalInfo.begin(), E = CalleeFR->GlobalInfo.end();
428 FR.GlobalInfo[GI->first] |= GI->second;
429 FR.MayReadAnyGlobal |= CalleeFR->MayReadAnyGlobal;
431 // Can't say anything about it. However, if it is inside our SCC,
432 // then nothing needs to be done.
433 CallGraphNode *CalleeNode = CG[Callee];
434 if (std::find(SCC.begin(), SCC.end(), CalleeNode) == SCC.end())
442 // If we can't say anything useful about this SCC, remove all SCC functions
443 // from the FunctionInfo map.
445 for (unsigned i = 0, e = SCC.size(); i != e; ++i)
446 FunctionInfo.erase(SCC[i]->getFunction());
450 // Scan the function bodies for explicit loads or stores.
451 for (unsigned i = 0, e = SCC.size(); i != e && FunctionEffect != ModRef;++i)
452 for (inst_iterator II = inst_begin(SCC[i]->getFunction()),
453 E = inst_end(SCC[i]->getFunction());
454 II != E && FunctionEffect != ModRef; ++II)
455 if (isa<LoadInst>(*II)) {
456 FunctionEffect |= Ref;
457 if (cast<LoadInst>(*II).isVolatile())
458 // Volatile loads may have side-effects, so mark them as writing
459 // memory (for example, a flag inside the processor).
460 FunctionEffect |= Mod;
461 } else if (isa<StoreInst>(*II)) {
462 FunctionEffect |= Mod;
463 if (cast<StoreInst>(*II).isVolatile())
464 // Treat volatile stores as reading memory somewhere.
465 FunctionEffect |= Ref;
466 } else if (isMalloc(&cast<Instruction>(*II)) ||
467 isFreeCall(&cast<Instruction>(*II))) {
468 FunctionEffect |= ModRef;
471 if ((FunctionEffect & Mod) == 0)
472 ++NumReadMemFunctions;
473 if (FunctionEffect == 0)
475 FR.FunctionEffect = FunctionEffect;
477 // Finally, now that we know the full effect on this SCC, clone the
478 // information to each function in the SCC.
479 for (unsigned i = 1, e = SCC.size(); i != e; ++i)
480 FunctionInfo[SCC[i]->getFunction()] = FR;
486 /// alias - If one of the pointers is to a global that we are tracking, and the
487 /// other is some random pointer, we know there cannot be an alias, because the
488 /// address of the global isn't taken.
489 AliasAnalysis::AliasResult
490 GlobalsModRef::alias(const Location &LocA,
491 const Location &LocB) {
492 // Get the base object these pointers point to.
493 const Value *UV1 = GetUnderlyingObject(LocA.Ptr);
494 const Value *UV2 = GetUnderlyingObject(LocB.Ptr);
496 // If either of the underlying values is a global, they may be non-addr-taken
497 // globals, which we can answer queries about.
498 const GlobalValue *GV1 = dyn_cast<GlobalValue>(UV1);
499 const GlobalValue *GV2 = dyn_cast<GlobalValue>(UV2);
501 // If the global's address is taken, pretend we don't know it's a pointer to
503 if (GV1 && !NonAddressTakenGlobals.count(GV1)) GV1 = 0;
504 if (GV2 && !NonAddressTakenGlobals.count(GV2)) GV2 = 0;
506 // If the two pointers are derived from two different non-addr-taken
507 // globals, or if one is and the other isn't, we know these can't alias.
508 if ((GV1 || GV2) && GV1 != GV2)
511 // Otherwise if they are both derived from the same addr-taken global, we
512 // can't know the two accesses don't overlap.
515 // These pointers may be based on the memory owned by an indirect global. If
516 // so, we may be able to handle this. First check to see if the base pointer
517 // is a direct load from an indirect global.
519 if (const LoadInst *LI = dyn_cast<LoadInst>(UV1))
520 if (GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0)))
521 if (IndirectGlobals.count(GV))
523 if (const LoadInst *LI = dyn_cast<LoadInst>(UV2))
524 if (const GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0)))
525 if (IndirectGlobals.count(GV))
528 // These pointers may also be from an allocation for the indirect global. If
529 // so, also handle them.
530 if (AllocsForIndirectGlobals.count(UV1))
531 GV1 = AllocsForIndirectGlobals[UV1];
532 if (AllocsForIndirectGlobals.count(UV2))
533 GV2 = AllocsForIndirectGlobals[UV2];
535 // Now that we know whether the two pointers are related to indirect globals,
536 // use this to disambiguate the pointers. If either pointer is based on an
537 // indirect global and if they are not both based on the same indirect global,
538 // they cannot alias.
539 if ((GV1 || GV2) && GV1 != GV2)
542 return AliasAnalysis::alias(LocA, LocB);
545 AliasAnalysis::ModRefResult
546 GlobalsModRef::getModRefInfo(ImmutableCallSite CS,
547 const Location &Loc) {
548 unsigned Known = ModRef;
550 // If we are asking for mod/ref info of a direct call with a pointer to a
551 // global we are tracking, return information if we have it.
552 if (const GlobalValue *GV =
553 dyn_cast<GlobalValue>(GetUnderlyingObject(Loc.Ptr)))
554 if (GV->hasLocalLinkage())
555 if (const Function *F = CS.getCalledFunction())
556 if (NonAddressTakenGlobals.count(GV))
557 if (const FunctionRecord *FR = getFunctionInfo(F))
558 Known = FR->getInfoForGlobal(GV);
560 if (Known == NoModRef)
561 return NoModRef; // No need to query other mod/ref analyses
562 return ModRefResult(Known & AliasAnalysis::getModRefInfo(CS, Loc));
566 //===----------------------------------------------------------------------===//
567 // Methods to update the analysis as a result of the client transformation.
569 void GlobalsModRef::deleteValue(Value *V) {
570 if (GlobalValue *GV = dyn_cast<GlobalValue>(V)) {
571 if (NonAddressTakenGlobals.erase(GV)) {
572 // This global might be an indirect global. If so, remove it and remove
573 // any AllocRelatedValues for it.
574 if (IndirectGlobals.erase(GV)) {
575 // Remove any entries in AllocsForIndirectGlobals for this global.
576 for (std::map<const Value*, const GlobalValue*>::iterator
577 I = AllocsForIndirectGlobals.begin(),
578 E = AllocsForIndirectGlobals.end(); I != E; ) {
579 if (I->second == GV) {
580 AllocsForIndirectGlobals.erase(I++);
589 // Otherwise, if this is an allocation related to an indirect global, remove
591 AllocsForIndirectGlobals.erase(V);
593 AliasAnalysis::deleteValue(V);
596 void GlobalsModRef::copyValue(Value *From, Value *To) {
597 AliasAnalysis::copyValue(From, To);