Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 1 | ================================== |
| 2 | LLVM Alias Analysis Infrastructure |
| 3 | ================================== |
| 4 | |
| 5 | .. contents:: |
| 6 | :local: |
| 7 | |
| 8 | Introduction |
| 9 | ============ |
| 10 | |
| 11 | Alias Analysis (aka Pointer Analysis) is a class of techniques which attempt to |
| 12 | determine whether or not two pointers ever can point to the same object in |
| 13 | memory. There are many different algorithms for alias analysis and many |
| 14 | different ways of classifying them: flow-sensitive vs. flow-insensitive, |
| 15 | context-sensitive vs. context-insensitive, field-sensitive |
| 16 | vs. field-insensitive, unification-based vs. subset-based, etc. Traditionally, |
| 17 | alias analyses respond to a query with a `Must, May, or No`_ alias response, |
| 18 | indicating that two pointers always point to the same object, might point to the |
| 19 | same object, or are known to never point to the same object. |
| 20 | |
| 21 | The LLVM `AliasAnalysis |
| 22 | <http://llvm.org/doxygen/classllvm_1_1AliasAnalysis.html>`__ class is the |
| 23 | primary interface used by clients and implementations of alias analyses in the |
| 24 | LLVM system. This class is the common interface between clients of alias |
| 25 | analysis information and the implementations providing it, and is designed to |
| 26 | support a wide range of implementations and clients (but currently all clients |
| 27 | are assumed to be flow-insensitive). In addition to simple alias analysis |
| 28 | information, this class exposes Mod/Ref information from those implementations |
| 29 | which can provide it, allowing for powerful analyses and transformations to work |
| 30 | well together. |
| 31 | |
| 32 | This document contains information necessary to successfully implement this |
| 33 | interface, use it, and to test both sides. It also explains some of the finer |
Chris Lattner | bac9cdf | 2016-06-23 16:29:22 +0000 | [diff] [blame] | 34 | points about what exactly results mean. |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 35 | |
| 36 | ``AliasAnalysis`` Class Overview |
| 37 | ================================ |
| 38 | |
| 39 | The `AliasAnalysis <http://llvm.org/doxygen/classllvm_1_1AliasAnalysis.html>`__ |
| 40 | class defines the interface that the various alias analysis implementations |
| 41 | should support. This class exports two important enums: ``AliasResult`` and |
| 42 | ``ModRefResult`` which represent the result of an alias query or a mod/ref |
| 43 | query, respectively. |
| 44 | |
| 45 | The ``AliasAnalysis`` interface exposes information about memory, represented in |
| 46 | several different ways. In particular, memory objects are represented as a |
| 47 | starting address and size, and function calls are represented as the actual |
| 48 | ``call`` or ``invoke`` instructions that performs the call. The |
| 49 | ``AliasAnalysis`` interface also exposes some helper methods which allow you to |
| 50 | get mod/ref information for arbitrary instructions. |
| 51 | |
| 52 | All ``AliasAnalysis`` interfaces require that in queries involving multiple |
Sean Silva | 0a50cec | 2014-04-08 21:06:22 +0000 | [diff] [blame] | 53 | values, values which are not :ref:`constants <constants>` are all |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 54 | defined within the same function. |
| 55 | |
| 56 | Representation of Pointers |
| 57 | -------------------------- |
| 58 | |
| 59 | Most importantly, the ``AliasAnalysis`` class provides several methods which are |
| 60 | used to query whether or not two memory objects alias, whether function calls |
| 61 | can modify or read a memory object, etc. For all of these queries, memory |
| 62 | objects are represented as a pair of their starting address (a symbolic LLVM |
| 63 | ``Value*``) and a static size. |
| 64 | |
| 65 | Representing memory objects as a starting address and a size is critically |
| 66 | important for correct Alias Analyses. For example, consider this (silly, but |
| 67 | possible) C code: |
| 68 | |
| 69 | .. code-block:: c++ |
| 70 | |
| 71 | int i; |
| 72 | char C[2]; |
| 73 | char A[10]; |
| 74 | /* ... */ |
| 75 | for (i = 0; i != 10; ++i) { |
| 76 | C[0] = A[i]; /* One byte store */ |
| 77 | C[1] = A[9-i]; /* One byte store */ |
| 78 | } |
| 79 | |
| 80 | In this case, the ``basicaa`` pass will disambiguate the stores to ``C[0]`` and |
| 81 | ``C[1]`` because they are accesses to two distinct locations one byte apart, and |
| 82 | the accesses are each one byte. In this case, the Loop Invariant Code Motion |
| 83 | (LICM) pass can use store motion to remove the stores from the loop. In |
| 84 | constrast, the following code: |
| 85 | |
| 86 | .. code-block:: c++ |
| 87 | |
| 88 | int i; |
| 89 | char C[2]; |
| 90 | char A[10]; |
| 91 | /* ... */ |
| 92 | for (i = 0; i != 10; ++i) { |
| 93 | ((short*)C)[0] = A[i]; /* Two byte store! */ |
| 94 | C[1] = A[9-i]; /* One byte store */ |
| 95 | } |
| 96 | |
| 97 | In this case, the two stores to C do alias each other, because the access to the |
| 98 | ``&C[0]`` element is a two byte access. If size information wasn't available in |
| 99 | the query, even the first case would have to conservatively assume that the |
| 100 | accesses alias. |
| 101 | |
| 102 | .. _alias: |
| 103 | |
| 104 | The ``alias`` method |
| 105 | -------------------- |
| 106 | |
| 107 | The ``alias`` method is the primary interface used to determine whether or not |
| 108 | two memory objects alias each other. It takes two memory objects as input and |
| 109 | returns MustAlias, PartialAlias, MayAlias, or NoAlias as appropriate. |
| 110 | |
| 111 | Like all ``AliasAnalysis`` interfaces, the ``alias`` method requires that either |
| 112 | the two pointer values be defined within the same function, or at least one of |
Sean Silva | 0a50cec | 2014-04-08 21:06:22 +0000 | [diff] [blame] | 113 | the values is a :ref:`constant <constants>`. |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 114 | |
| 115 | .. _Must, May, or No: |
| 116 | |
| 117 | Must, May, and No Alias Responses |
| 118 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
| 119 | |
| 120 | The ``NoAlias`` response may be used when there is never an immediate dependence |
| 121 | between any memory reference *based* on one pointer and any memory reference |
| 122 | *based* the other. The most obvious example is when the two pointers point to |
| 123 | non-overlapping memory ranges. Another is when the two pointers are only ever |
| 124 | used for reading memory. Another is when the memory is freed and reallocated |
| 125 | between accesses through one pointer and accesses through the other --- in this |
| 126 | case, there is a dependence, but it's mediated by the free and reallocation. |
| 127 | |
Sean Silva | 0a50cec | 2014-04-08 21:06:22 +0000 | [diff] [blame] | 128 | As an exception to this is with the :ref:`noalias <noalias>` keyword; |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 129 | the "irrelevant" dependencies are ignored. |
| 130 | |
| 131 | The ``MayAlias`` response is used whenever the two pointers might refer to the |
| 132 | same object. |
| 133 | |
| 134 | The ``PartialAlias`` response is used when the two memory objects are known to |
Nuno Lopes | 4b03014 | 2017-07-15 09:09:24 +0000 | [diff] [blame] | 135 | be overlapping in some way, regardless whether they start at the same address |
| 136 | or not. |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 137 | |
| 138 | The ``MustAlias`` response may only be returned if the two memory objects are |
| 139 | guaranteed to always start at exactly the same location. A ``MustAlias`` |
Piotr Padlewski | 3512d22 | 2017-04-12 07:59:35 +0000 | [diff] [blame] | 140 | response does not imply that the pointers compare equal. |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 141 | |
| 142 | The ``getModRefInfo`` methods |
| 143 | ----------------------------- |
| 144 | |
| 145 | The ``getModRefInfo`` methods return information about whether the execution of |
| 146 | an instruction can read or modify a memory location. Mod/Ref information is |
| 147 | always conservative: if an instruction **might** read or write a location, |
| 148 | ``ModRef`` is returned. |
| 149 | |
| 150 | The ``AliasAnalysis`` class also provides a ``getModRefInfo`` method for testing |
| 151 | dependencies between function calls. This method takes two call sites (``CS1`` |
| 152 | & ``CS2``), returns ``NoModRef`` if neither call writes to memory read or |
| 153 | written by the other, ``Ref`` if ``CS1`` reads memory written by ``CS2``, |
| 154 | ``Mod`` if ``CS1`` writes to memory read or written by ``CS2``, or ``ModRef`` if |
| 155 | ``CS1`` might read or write memory written to by ``CS2``. Note that this |
| 156 | relation is not commutative. |
| 157 | |
| 158 | Other useful ``AliasAnalysis`` methods |
| 159 | -------------------------------------- |
| 160 | |
| 161 | Several other tidbits of information are often collected by various alias |
| 162 | analysis implementations and can be put to good use by various clients. |
| 163 | |
| 164 | The ``pointsToConstantMemory`` method |
| 165 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
| 166 | |
| 167 | The ``pointsToConstantMemory`` method returns true if and only if the analysis |
| 168 | can prove that the pointer only points to unchanging memory locations |
| 169 | (functions, constant global variables, and the null pointer). This information |
| 170 | can be used to refine mod/ref information: it is impossible for an unchanging |
| 171 | memory location to be modified. |
| 172 | |
| 173 | .. _never access memory or only read memory: |
| 174 | |
| 175 | The ``doesNotAccessMemory`` and ``onlyReadsMemory`` methods |
| 176 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
| 177 | |
| 178 | These methods are used to provide very simple mod/ref information for function |
| 179 | calls. The ``doesNotAccessMemory`` method returns true for a function if the |
| 180 | analysis can prove that the function never reads or writes to memory, or if the |
| 181 | function only reads from constant memory. Functions with this property are |
| 182 | side-effect free and only depend on their input arguments, allowing them to be |
| 183 | eliminated if they form common subexpressions or be hoisted out of loops. Many |
| 184 | common functions behave this way (e.g., ``sin`` and ``cos``) but many others do |
| 185 | not (e.g., ``acos``, which modifies the ``errno`` variable). |
| 186 | |
| 187 | The ``onlyReadsMemory`` method returns true for a function if analysis can prove |
| 188 | that (at most) the function only reads from non-volatile memory. Functions with |
| 189 | this property are side-effect free, only depending on their input arguments and |
| 190 | the state of memory when they are called. This property allows calls to these |
| 191 | functions to be eliminated and moved around, as long as there is no store |
| 192 | instruction that changes the contents of memory. Note that all functions that |
Sanjay Patel | 57353d1 | 2016-01-13 16:46:41 +0000 | [diff] [blame] | 193 | satisfy the ``doesNotAccessMemory`` method also satisfy ``onlyReadsMemory``. |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 194 | |
| 195 | Writing a new ``AliasAnalysis`` Implementation |
| 196 | ============================================== |
| 197 | |
| 198 | Writing a new alias analysis implementation for LLVM is quite straight-forward. |
| 199 | There are already several implementations that you can use for examples, and the |
| 200 | following information should help fill in any details. For a examples, take a |
| 201 | look at the `various alias analysis implementations`_ included with LLVM. |
| 202 | |
| 203 | Different Pass styles |
| 204 | --------------------- |
| 205 | |
Dmitri Gribenko | 5eabd76 | 2012-12-12 17:03:50 +0000 | [diff] [blame] | 206 | The first step to determining what type of :doc:`LLVM pass <WritingAnLLVMPass>` |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 207 | you need to use for your Alias Analysis. As is the case with most other |
| 208 | analyses and transformations, the answer should be fairly obvious from what type |
| 209 | of problem you are trying to solve: |
| 210 | |
| 211 | #. If you require interprocedural analysis, it should be a ``Pass``. |
| 212 | #. If you are a function-local analysis, subclass ``FunctionPass``. |
| 213 | #. If you don't need to look at the program at all, subclass ``ImmutablePass``. |
| 214 | |
| 215 | In addition to the pass that you subclass, you should also inherit from the |
| 216 | ``AliasAnalysis`` interface, of course, and use the ``RegisterAnalysisGroup`` |
| 217 | template to register as an implementation of ``AliasAnalysis``. |
| 218 | |
| 219 | Required initialization calls |
| 220 | ----------------------------- |
| 221 | |
| 222 | Your subclass of ``AliasAnalysis`` is required to invoke two methods on the |
| 223 | ``AliasAnalysis`` base class: ``getAnalysisUsage`` and |
| 224 | ``InitializeAliasAnalysis``. In particular, your implementation of |
| 225 | ``getAnalysisUsage`` should explicitly call into the |
| 226 | ``AliasAnalysis::getAnalysisUsage`` method in addition to doing any declaring |
| 227 | any pass dependencies your pass has. Thus you should have something like this: |
| 228 | |
| 229 | .. code-block:: c++ |
| 230 | |
Dmitri Gribenko | 8bd5e35 | 2012-09-30 20:51:02 +0000 | [diff] [blame] | 231 | void getAnalysisUsage(AnalysisUsage &AU) const { |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 232 | AliasAnalysis::getAnalysisUsage(AU); |
| 233 | // declare your dependencies here. |
| 234 | } |
| 235 | |
| 236 | Additionally, your must invoke the ``InitializeAliasAnalysis`` method from your |
| 237 | analysis run method (``run`` for a ``Pass``, ``runOnFunction`` for a |
| 238 | ``FunctionPass``, or ``InitializePass`` for an ``ImmutablePass``). For example |
| 239 | (as part of a ``Pass``): |
| 240 | |
| 241 | .. code-block:: c++ |
| 242 | |
| 243 | bool run(Module &M) { |
| 244 | InitializeAliasAnalysis(this); |
| 245 | // Perform analysis here... |
| 246 | return false; |
| 247 | } |
| 248 | |
Eric Christopher | ff93350 | 2014-05-22 19:38:25 +0000 | [diff] [blame] | 249 | Required methods to override |
| 250 | ---------------------------- |
| 251 | |
| 252 | You must override the ``getAdjustedAnalysisPointer`` method on all subclasses |
| 253 | of ``AliasAnalysis``. An example implementation of this method would look like: |
| 254 | |
| 255 | .. code-block:: c++ |
| 256 | |
| 257 | void *getAdjustedAnalysisPointer(const void* ID) override { |
| 258 | if (ID == &AliasAnalysis::ID) |
| 259 | return (AliasAnalysis*)this; |
| 260 | return this; |
| 261 | } |
| 262 | |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 263 | Interfaces which may be specified |
| 264 | --------------------------------- |
| 265 | |
| 266 | All of the `AliasAnalysis |
| 267 | <http://llvm.org/doxygen/classllvm_1_1AliasAnalysis.html>`__ virtual methods |
Dmitri Gribenko | 5eabd76 | 2012-12-12 17:03:50 +0000 | [diff] [blame] | 268 | default to providing :ref:`chaining <aliasanalysis-chaining>` to another alias |
| 269 | analysis implementation, which ends up returning conservatively correct |
| 270 | information (returning "May" Alias and "Mod/Ref" for alias and mod/ref queries |
| 271 | respectively). Depending on the capabilities of the analysis you are |
| 272 | implementing, you just override the interfaces you can improve. |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 273 | |
Dmitri Gribenko | 5eabd76 | 2012-12-12 17:03:50 +0000 | [diff] [blame] | 274 | .. _aliasanalysis-chaining: |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 275 | |
| 276 | ``AliasAnalysis`` chaining behavior |
| 277 | ----------------------------------- |
| 278 | |
Dmitri Gribenko | 5eabd76 | 2012-12-12 17:03:50 +0000 | [diff] [blame] | 279 | With only one special exception (the :ref:`-no-aa <aliasanalysis-no-aa>` pass) |
| 280 | every alias analysis pass chains to another alias analysis implementation (for |
| 281 | example, the user can specify "``-basicaa -ds-aa -licm``" to get the maximum |
| 282 | benefit from both alias analyses). The alias analysis class automatically |
| 283 | takes care of most of this for methods that you don't override. For methods |
| 284 | that you do override, in code paths that return a conservative MayAlias or |
| 285 | Mod/Ref result, simply return whatever the superclass computes. For example: |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 286 | |
| 287 | .. code-block:: c++ |
| 288 | |
Chandler Carruth | 1e3557d | 2015-06-22 02:16:51 +0000 | [diff] [blame] | 289 | AliasResult alias(const Value *V1, unsigned V1Size, |
| 290 | const Value *V2, unsigned V2Size) { |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 291 | if (...) |
| 292 | return NoAlias; |
| 293 | ... |
| 294 | |
| 295 | // Couldn't determine a must or no-alias result. |
| 296 | return AliasAnalysis::alias(V1, V1Size, V2, V2Size); |
| 297 | } |
| 298 | |
| 299 | In addition to analysis queries, you must make sure to unconditionally pass LLVM |
| 300 | `update notification`_ methods to the superclass as well if you override them, |
| 301 | which allows all alias analyses in a change to be updated. |
| 302 | |
| 303 | .. _update notification: |
| 304 | |
| 305 | Updating analysis results for transformations |
| 306 | --------------------------------------------- |
| 307 | |
| 308 | Alias analysis information is initially computed for a static snapshot of the |
| 309 | program, but clients will use this information to make transformations to the |
| 310 | code. All but the most trivial forms of alias analysis will need to have their |
| 311 | analysis results updated to reflect the changes made by these transformations. |
| 312 | |
| 313 | The ``AliasAnalysis`` interface exposes four methods which are used to |
| 314 | communicate program changes from the clients to the analysis implementations. |
| 315 | Various alias analysis implementations should use these methods to ensure that |
| 316 | their internal data structures are kept up-to-date as the program changes (for |
| 317 | example, when an instruction is deleted), and clients of alias analysis must be |
| 318 | sure to call these interfaces appropriately. |
| 319 | |
| 320 | The ``deleteValue`` method |
| 321 | ^^^^^^^^^^^^^^^^^^^^^^^^^^ |
| 322 | |
| 323 | The ``deleteValue`` method is called by transformations when they remove an |
| 324 | instruction or any other value from the program (including values that do not |
| 325 | use pointers). Typically alias analyses keep data structures that have entries |
| 326 | for each value in the program. When this method is called, they should remove |
| 327 | any entries for the specified value, if they exist. |
| 328 | |
| 329 | The ``copyValue`` method |
| 330 | ^^^^^^^^^^^^^^^^^^^^^^^^ |
| 331 | |
| 332 | The ``copyValue`` method is used when a new value is introduced into the |
| 333 | program. There is no way to introduce a value into the program that did not |
| 334 | exist before (this doesn't make sense for a safe compiler transformation), so |
| 335 | this is the only way to introduce a new value. This method indicates that the |
| 336 | new value has exactly the same properties as the value being copied. |
| 337 | |
| 338 | The ``replaceWithNewValue`` method |
| 339 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
| 340 | |
| 341 | This method is a simple helper method that is provided to make clients easier to |
| 342 | use. It is implemented by copying the old analysis information to the new |
| 343 | value, then deleting the old value. This method cannot be overridden by alias |
| 344 | analysis implementations. |
| 345 | |
| 346 | The ``addEscapingUse`` method |
| 347 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
| 348 | |
| 349 | The ``addEscapingUse`` method is used when the uses of a pointer value have |
| 350 | changed in ways that may invalidate precomputed analysis information. |
| 351 | Implementations may either use this callback to provide conservative responses |
| 352 | for points whose uses have change since analysis time, or may recompute some or |
| 353 | all of their internal state to continue providing accurate responses. |
| 354 | |
| 355 | In general, any new use of a pointer value is considered an escaping use, and |
| 356 | must be reported through this callback, *except* for the uses below: |
| 357 | |
| 358 | * A ``bitcast`` or ``getelementptr`` of the pointer |
| 359 | * A ``store`` through the pointer (but not a ``store`` *of* the pointer) |
| 360 | * A ``load`` through the pointer |
| 361 | |
| 362 | Efficiency Issues |
| 363 | ----------------- |
| 364 | |
| 365 | From the LLVM perspective, the only thing you need to do to provide an efficient |
| 366 | alias analysis is to make sure that alias analysis **queries** are serviced |
| 367 | quickly. The actual calculation of the alias analysis results (the "run" |
| 368 | method) is only performed once, but many (perhaps duplicate) queries may be |
| 369 | performed. Because of this, try to move as much computation to the run method |
| 370 | as possible (within reason). |
| 371 | |
| 372 | Limitations |
| 373 | ----------- |
| 374 | |
| 375 | The AliasAnalysis infrastructure has several limitations which make writing a |
| 376 | new ``AliasAnalysis`` implementation difficult. |
| 377 | |
| 378 | There is no way to override the default alias analysis. It would be very useful |
| 379 | to be able to do something like "``opt -my-aa -O2``" and have it use ``-my-aa`` |
| 380 | for all passes which need AliasAnalysis, but there is currently no support for |
| 381 | that, short of changing the source code and recompiling. Similarly, there is |
| 382 | also no way of setting a chain of analyses as the default. |
| 383 | |
| 384 | There is no way for transform passes to declare that they preserve |
| 385 | ``AliasAnalysis`` implementations. The ``AliasAnalysis`` interface includes |
| 386 | ``deleteValue`` and ``copyValue`` methods which are intended to allow a pass to |
| 387 | keep an AliasAnalysis consistent, however there's no way for a pass to declare |
| 388 | in its ``getAnalysisUsage`` that it does so. Some passes attempt to use |
| 389 | ``AU.addPreserved<AliasAnalysis>``, however this doesn't actually have any |
| 390 | effect. |
| 391 | |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 392 | Similarly, the ``opt -p`` option introduces ``ModulePass`` passes between each |
| 393 | pass, which prevents the use of ``FunctionPass`` alias analysis passes. |
| 394 | |
| 395 | The ``AliasAnalysis`` API does have functions for notifying implementations when |
| 396 | values are deleted or copied, however these aren't sufficient. There are many |
| 397 | other ways that LLVM IR can be modified which could be relevant to |
| 398 | ``AliasAnalysis`` implementations which can not be expressed. |
| 399 | |
| 400 | The ``AliasAnalysisDebugger`` utility seems to suggest that ``AliasAnalysis`` |
| 401 | implementations can expect that they will be informed of any relevant ``Value`` |
| 402 | before it appears in an alias query. However, popular clients such as ``GVN`` |
| 403 | don't support this, and are known to trigger errors when run with the |
| 404 | ``AliasAnalysisDebugger``. |
| 405 | |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 406 | The ``AliasSetTracker`` class (which is used by ``LICM``) makes a |
Marianne Mailhot-Sarrasin | 75dd90e | 2018-04-23 13:45:28 +0000 | [diff] [blame] | 407 | non-deterministic number of alias queries. This can cause debugging techniques |
| 408 | involving pausing execution after a predetermined number of queries to be |
| 409 | unreliable. |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 410 | |
| 411 | Many alias queries can be reformulated in terms of other alias queries. When |
| 412 | multiple ``AliasAnalysis`` queries are chained together, it would make sense to |
| 413 | start those queries from the beginning of the chain, with care taken to avoid |
| 414 | infinite looping, however currently an implementation which wants to do this can |
| 415 | only start such queries from itself. |
| 416 | |
| 417 | Using alias analysis results |
| 418 | ============================ |
| 419 | |
| 420 | There are several different ways to use alias analysis results. In order of |
| 421 | preference, these are: |
| 422 | |
| 423 | Using the ``MemoryDependenceAnalysis`` Pass |
| 424 | ------------------------------------------- |
| 425 | |
| 426 | The ``memdep`` pass uses alias analysis to provide high-level dependence |
| 427 | information about memory-using instructions. This will tell you which store |
| 428 | feeds into a load, for example. It uses caching and other techniques to be |
| 429 | efficient, and is used by Dead Store Elimination, GVN, and memcpy optimizations. |
| 430 | |
| 431 | .. _AliasSetTracker: |
| 432 | |
| 433 | Using the ``AliasSetTracker`` class |
| 434 | ----------------------------------- |
| 435 | |
| 436 | Many transformations need information about alias **sets** that are active in |
| 437 | some scope, rather than information about pairwise aliasing. The |
| 438 | `AliasSetTracker <http://llvm.org/doxygen/classllvm_1_1AliasSetTracker.html>`__ |
| 439 | class is used to efficiently build these Alias Sets from the pairwise alias |
| 440 | analysis information provided by the ``AliasAnalysis`` interface. |
| 441 | |
| 442 | First you initialize the AliasSetTracker by using the "``add``" methods to add |
| 443 | information about various potentially aliasing instructions in the scope you are |
| 444 | interested in. Once all of the alias sets are completed, your pass should |
| 445 | simply iterate through the constructed alias sets, using the ``AliasSetTracker`` |
| 446 | ``begin()``/``end()`` methods. |
| 447 | |
| 448 | The ``AliasSet``\s formed by the ``AliasSetTracker`` are guaranteed to be |
| 449 | disjoint, calculate mod/ref information and volatility for the set, and keep |
| 450 | track of whether or not all of the pointers in the set are Must aliases. The |
| 451 | AliasSetTracker also makes sure that sets are properly folded due to call |
| 452 | instructions, and can provide a list of pointers in each set. |
| 453 | |
| 454 | As an example user of this, the `Loop Invariant Code Motion |
| 455 | <doxygen/structLICM.html>`_ pass uses ``AliasSetTracker``\s to calculate alias |
| 456 | sets for each loop nest. If an ``AliasSet`` in a loop is not modified, then all |
| 457 | load instructions from that set may be hoisted out of the loop. If any alias |
| 458 | sets are stored to **and** are must alias sets, then the stores may be sunk |
| 459 | to outside of the loop, promoting the memory location to a register for the |
| 460 | duration of the loop nest. Both of these transformations only apply if the |
| 461 | pointer argument is loop-invariant. |
| 462 | |
| 463 | The AliasSetTracker implementation |
| 464 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
| 465 | |
| 466 | The AliasSetTracker class is implemented to be as efficient as possible. It |
| 467 | uses the union-find algorithm to efficiently merge AliasSets when a pointer is |
| 468 | inserted into the AliasSetTracker that aliases multiple sets. The primary data |
| 469 | structure is a hash table mapping pointers to the AliasSet they are in. |
| 470 | |
| 471 | The AliasSetTracker class must maintain a list of all of the LLVM ``Value*``\s |
| 472 | that are in each AliasSet. Since the hash table already has entries for each |
| 473 | LLVM ``Value*`` of interest, the AliasesSets thread the linked list through |
| 474 | these hash-table nodes to avoid having to allocate memory unnecessarily, and to |
| 475 | make merging alias sets extremely efficient (the linked list merge is constant |
| 476 | time). |
| 477 | |
| 478 | You shouldn't need to understand these details if you are just a client of the |
| 479 | AliasSetTracker, but if you look at the code, hopefully this brief description |
| 480 | will help make sense of why things are designed the way they are. |
| 481 | |
| 482 | Using the ``AliasAnalysis`` interface directly |
| 483 | ---------------------------------------------- |
| 484 | |
| 485 | If neither of these utility class are what your pass needs, you should use the |
| 486 | interfaces exposed by the ``AliasAnalysis`` class directly. Try to use the |
| 487 | higher-level methods when possible (e.g., use mod/ref information instead of the |
| 488 | `alias`_ method directly if possible) to get the best precision and efficiency. |
| 489 | |
| 490 | Existing alias analysis implementations and clients |
| 491 | =================================================== |
| 492 | |
| 493 | If you're going to be working with the LLVM alias analysis infrastructure, you |
| 494 | should know what clients and implementations of alias analysis are available. |
| 495 | In particular, if you are implementing an alias analysis, you should be aware of |
| 496 | the `the clients`_ that are useful for monitoring and evaluating different |
| 497 | implementations. |
| 498 | |
| 499 | .. _various alias analysis implementations: |
| 500 | |
| 501 | Available ``AliasAnalysis`` implementations |
| 502 | ------------------------------------------- |
| 503 | |
| 504 | This section lists the various implementations of the ``AliasAnalysis`` |
Dmitri Gribenko | 5eabd76 | 2012-12-12 17:03:50 +0000 | [diff] [blame] | 505 | interface. With the exception of the :ref:`-no-aa <aliasanalysis-no-aa>` |
| 506 | implementation, all of these :ref:`chain <aliasanalysis-chaining>` to other |
| 507 | alias analysis implementations. |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 508 | |
Dmitri Gribenko | 5eabd76 | 2012-12-12 17:03:50 +0000 | [diff] [blame] | 509 | .. _aliasanalysis-no-aa: |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 510 | |
| 511 | The ``-no-aa`` pass |
| 512 | ^^^^^^^^^^^^^^^^^^^ |
| 513 | |
| 514 | The ``-no-aa`` pass is just like what it sounds: an alias analysis that never |
| 515 | returns any useful information. This pass can be useful if you think that alias |
| 516 | analysis is doing something wrong and are trying to narrow down a problem. |
| 517 | |
| 518 | The ``-basicaa`` pass |
| 519 | ^^^^^^^^^^^^^^^^^^^^^ |
| 520 | |
| 521 | The ``-basicaa`` pass is an aggressive local analysis that *knows* many |
| 522 | important facts: |
| 523 | |
| 524 | * Distinct globals, stack allocations, and heap allocations can never alias. |
| 525 | * Globals, stack allocations, and heap allocations never alias the null pointer. |
| 526 | * Different fields of a structure do not alias. |
| 527 | * Indexes into arrays with statically differing subscripts cannot alias. |
| 528 | * Many common standard C library functions `never access memory or only read |
| 529 | memory`_. |
| 530 | * Pointers that obviously point to constant globals "``pointToConstantMemory``". |
| 531 | * Function calls can not modify or references stack allocations if they never |
| 532 | escape from the function that allocates them (a common case for automatic |
| 533 | arrays). |
| 534 | |
| 535 | The ``-globalsmodref-aa`` pass |
| 536 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
| 537 | |
| 538 | This pass implements a simple context-sensitive mod/ref and alias analysis for |
| 539 | internal global variables that don't "have their address taken". If a global |
| 540 | does not have its address taken, the pass knows that no pointers alias the |
| 541 | global. This pass also keeps track of functions that it knows never access |
| 542 | memory or never read memory. This allows certain optimizations (e.g. GVN) to |
| 543 | eliminate call instructions entirely. |
| 544 | |
| 545 | The real power of this pass is that it provides context-sensitive mod/ref |
| 546 | information for call instructions. This allows the optimizer to know that calls |
| 547 | to a function do not clobber or read the value of the global, allowing loads and |
| 548 | stores to be eliminated. |
| 549 | |
| 550 | .. note:: |
| 551 | |
| 552 | This pass is somewhat limited in its scope (only support non-address taken |
| 553 | globals), but is very quick analysis. |
| 554 | |
| 555 | The ``-steens-aa`` pass |
| 556 | ^^^^^^^^^^^^^^^^^^^^^^^ |
| 557 | |
| 558 | The ``-steens-aa`` pass implements a variation on the well-known "Steensgaard's |
| 559 | algorithm" for interprocedural alias analysis. Steensgaard's algorithm is a |
| 560 | unification-based, flow-insensitive, context-insensitive, and field-insensitive |
| 561 | alias analysis that is also very scalable (effectively linear time). |
| 562 | |
| 563 | The LLVM ``-steens-aa`` pass implements a "speculatively field-**sensitive**" |
| 564 | version of Steensgaard's algorithm using the Data Structure Analysis framework. |
| 565 | This gives it substantially more precision than the standard algorithm while |
| 566 | maintaining excellent analysis scalability. |
| 567 | |
| 568 | .. note:: |
| 569 | |
| 570 | ``-steens-aa`` is available in the optional "poolalloc" module. It is not part |
| 571 | of the LLVM core. |
| 572 | |
| 573 | The ``-ds-aa`` pass |
| 574 | ^^^^^^^^^^^^^^^^^^^ |
| 575 | |
| 576 | The ``-ds-aa`` pass implements the full Data Structure Analysis algorithm. Data |
| 577 | Structure Analysis is a modular unification-based, flow-insensitive, |
| 578 | context-**sensitive**, and speculatively field-**sensitive** alias |
| 579 | analysis that is also quite scalable, usually at ``O(n * log(n))``. |
| 580 | |
| 581 | This algorithm is capable of responding to a full variety of alias analysis |
| 582 | queries, and can provide context-sensitive mod/ref information as well. The |
| 583 | only major facility not implemented so far is support for must-alias |
| 584 | information. |
| 585 | |
| 586 | .. note:: |
| 587 | |
| 588 | ``-ds-aa`` is available in the optional "poolalloc" module. It is not part of |
| 589 | the LLVM core. |
| 590 | |
| 591 | The ``-scev-aa`` pass |
| 592 | ^^^^^^^^^^^^^^^^^^^^^ |
| 593 | |
| 594 | The ``-scev-aa`` pass implements AliasAnalysis queries by translating them into |
| 595 | ScalarEvolution queries. This gives it a more complete understanding of |
| 596 | ``getelementptr`` instructions and loop induction variables than other alias |
| 597 | analyses have. |
| 598 | |
| 599 | Alias analysis driven transformations |
| 600 | ------------------------------------- |
| 601 | |
| 602 | LLVM includes several alias-analysis driven transformations which can be used |
| 603 | with any of the implementations above. |
| 604 | |
| 605 | The ``-adce`` pass |
| 606 | ^^^^^^^^^^^^^^^^^^ |
| 607 | |
| 608 | The ``-adce`` pass, which implements Aggressive Dead Code Elimination uses the |
| 609 | ``AliasAnalysis`` interface to delete calls to functions that do not have |
| 610 | side-effects and are not used. |
| 611 | |
| 612 | The ``-licm`` pass |
| 613 | ^^^^^^^^^^^^^^^^^^ |
| 614 | |
| 615 | The ``-licm`` pass implements various Loop Invariant Code Motion related |
| 616 | transformations. It uses the ``AliasAnalysis`` interface for several different |
| 617 | transformations: |
| 618 | |
| 619 | * It uses mod/ref information to hoist or sink load instructions out of loops if |
| 620 | there are no instructions in the loop that modifies the memory loaded. |
| 621 | |
| 622 | * It uses mod/ref information to hoist function calls out of loops that do not |
| 623 | write to memory and are loop-invariant. |
| 624 | |
Sanjay Patel | 56ae12b | 2016-01-13 16:30:44 +0000 | [diff] [blame] | 625 | * It uses alias information to promote memory objects that are loaded and stored |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 626 | to in loops to live in a register instead. It can do this if there are no may |
| 627 | aliases to the loaded/stored memory location. |
| 628 | |
| 629 | The ``-argpromotion`` pass |
| 630 | ^^^^^^^^^^^^^^^^^^^^^^^^^^ |
| 631 | |
| 632 | The ``-argpromotion`` pass promotes by-reference arguments to be passed in |
| 633 | by-value instead. In particular, if pointer arguments are only loaded from it |
| 634 | passes in the value loaded instead of the address to the function. This pass |
| 635 | uses alias information to make sure that the value loaded from the argument |
| 636 | pointer is not modified between the entry of the function and any load of the |
| 637 | pointer. |
| 638 | |
| 639 | The ``-gvn``, ``-memcpyopt``, and ``-dse`` passes |
| 640 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
| 641 | |
| 642 | These passes use AliasAnalysis information to reason about loads and stores. |
| 643 | |
| 644 | .. _the clients: |
| 645 | |
| 646 | Clients for debugging and evaluation of implementations |
| 647 | ------------------------------------------------------- |
| 648 | |
| 649 | These passes are useful for evaluating the various alias analysis |
| 650 | implementations. You can use them with commands like: |
| 651 | |
| 652 | .. code-block:: bash |
| 653 | |
| 654 | % opt -ds-aa -aa-eval foo.bc -disable-output -stats |
| 655 | |
| 656 | The ``-print-alias-sets`` pass |
| 657 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
| 658 | |
| 659 | The ``-print-alias-sets`` pass is exposed as part of the ``opt`` tool to print |
| 660 | out the Alias Sets formed by the `AliasSetTracker`_ class. This is useful if |
| 661 | you're using the ``AliasSetTracker`` class. To use it, use something like: |
| 662 | |
| 663 | .. code-block:: bash |
| 664 | |
| 665 | % opt -ds-aa -print-alias-sets -disable-output |
| 666 | |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 667 | The ``-aa-eval`` pass |
| 668 | ^^^^^^^^^^^^^^^^^^^^^ |
| 669 | |
| 670 | The ``-aa-eval`` pass simply iterates through all pairs of pointers in a |
| 671 | function and asks an alias analysis whether or not the pointers alias. This |
| 672 | gives an indication of the precision of the alias analysis. Statistics are |
| 673 | printed indicating the percent of no/may/must aliases found (a more precise |
| 674 | algorithm will have a lower number of may aliases). |
| 675 | |
| 676 | Memory Dependence Analysis |
| 677 | ========================== |
| 678 | |
George Burgess IV | 6058aba | 2016-08-17 00:17:29 +0000 | [diff] [blame] | 679 | .. note:: |
| 680 | |
| 681 | We are currently in the process of migrating things from |
| 682 | ``MemoryDependenceAnalysis`` to :doc:`MemorySSA`. Please try to use |
| 683 | that instead. |
| 684 | |
Bill Wendling | 430c3bb | 2012-06-20 09:49:57 +0000 | [diff] [blame] | 685 | If you're just looking to be a client of alias analysis information, consider |
| 686 | using the Memory Dependence Analysis interface instead. MemDep is a lazy, |
| 687 | caching layer on top of alias analysis that is able to answer the question of |
| 688 | what preceding memory operations a given instruction depends on, either at an |
| 689 | intra- or inter-block level. Because of its laziness and caching policy, using |
| 690 | MemDep can be a significant performance win over accessing alias analysis |
| 691 | directly. |