1. Introduction - What is a pass?
2. Quick Start - Writing hello world
   • Setting up the build environment
   • Basic code required
   • Running a pass with opt or analyze
3. Pass classes and requirements
   • The Pass class
     • The run method
   • The FunctionPass class
     • The doInitialization method
     • The runOnFunction method
     • The doFinalization method
   • The BasicBlockPass class
     • The runOnBasicBlock method
4. Pass Registration
   • The print method
5. Specifying interactions between passes
   • The getAnalysisUsage method
   • The getAnalysis method
6. What PassManager does
   • The releaseMemory method
7. Future extensions planned
   • Multithreaded LLVM
   • A new ModuleSource interface
   • Pass's requiring FunctionPass's

   Written by Chris Lattner

Introduction - What is a pass?

The LLVM Pass Framework is an important part of the LLVM system, because LLVM passes are where the interesting parts of the compiler exist. Passes perform the transformations and optimizations that make up the compiler, they build the analysis results that are used by these transformations, and they are, above all, a structuring technique for compiler code.

All LLVM passes are subclasses of the Pass class, which implement functionality by overriding virtual methods inherited from Pass. Depending on how your pass works, you may be able to inherit from the FunctionPass or BasicBlockPass, which gives the system more information about what your pass does, and how it can be combined with other passes. One of the main features of the LLVM Pass Framework is that it schedules passes to run in an efficient way based on the constraints that your pass has.

We start by showing you how to construct a pass, everything from setting up the code, to compiling, loading, and executing it. After the basics are down, more advanced features are discussed.

Here we describe how to write the "hello world" of passes. The "Hello" pass is designed to simply print out the name of non-external functions that exist in the program being compiled. It does not modify the program at all, just inspects it. The source code and files for this pass are available in the LLVM source tree in the lib/Transforms/Hello directory.

First thing you need to do is create a new directory somewhere in the LLVM source base. For this example, we'll assume that you made "lib/Transforms/Hello". The first thing you must do is set up a build script (Makefile) that will compile the source code for the new pass. To do this, copy this into "Makefile":

# Makefile for hello pass
LEVEL = ../../..                    # Path to top level of LLVM heirarchy
LIBRARYNAME = hello                 # Name of the library to build
SHARED_LIBRARY = 1                  # Build a dynamically loadable shared object

include $(LEVEL)/Makefile.common    # Include the makefile implementation stuff

This makefile specifies that all of the .cpp files in the current directory are to be compiled and linked together into a lib/Debug/libhello.so shared object that can be dynamically loaded by the opt or analyze tools.

Now that we have the build scripts set up, we just need to write the code for the pass itself.

Now that we have a way to compile our new pass, we just have to write it. Start out with:

#include "llvm/Pass.h"
#include "llvm/Function.h"

Which are needed because we are writing a Pass, and we are operating on Function's.

Next we have:

namespace {

... which starts out an anonymous namespace. Anonymous namespaces are to C++ what the "static" keyword is to C (at global scope). It makes the things declared inside of the anonymous namespace only visible to the current file. If you're not familiar with them, consult a decent C++ book for more information.

Next, we declare our pass itself:

  struct Hello : public FunctionPass {

This declares a "Hello" class that is a subclass of FunctionPass. The different builting pass subclasses are described in detail later, but for now, know that FunctionPass's operate a function at a time.

    virtual bool runOnFunction(Function &F) {
      std::cerr << "Hello: " << F.getName() << "\n";
      return false;
    }
  };  // end of struct Hello

We declare a "runOnFunction" method, which overloads an abstract virtual method inherited from FunctionPass. This is where we are supposed to do our thing, so we just print out our message with the name of each function.

  RegisterOpt<Hello> X("hello", "Hello World Pass");
}  // end of anonymous namespace

Lastly, we register our class Hello, giving it a command line argument "hello", and a name "Hello World Pass". There are several different ways of registering your pass, depending on what it is to be used for. For "optimizations" we use the RegisterOpt template.

As a whole, the .cpp file looks like:

#include "llvm/Pass.h"
#include "llvm/Function.h"

namespace {
  struct Hello : public FunctionPass {
    virtual bool runOnFunction(Function &F) {
      std::cerr << "Hello: " << F.getName() << "\n";
      return false;
    }
  };
  
  RegisterOpt<Hello> X("hello", "Hello World Pass");
}

Now that it's all together, compile the file with a simple "gmake" command in the local directory and you should get a new "lib/Debug/libhello.so file. Note that everything in this file is contained in an anonymous namespace: this reflects the fact that passes are self contained units that do not need external interfaces (although they can have them) to be useful.

Now that you have a brand new shiny .so file, we can use the opt command to run an LLVM program through your pass. Because you registered your pass with the RegisterOpt template, you will be able to use the opt tool to access it, once loaded.

To test it, follow the example at the end of the Getting Started Guide to compile "Hello World" to LLVM. We can now run the bytecode file (hello.bc) for the program through our transformation like this (or course, any bytecode file will work):

$ opt -load ../../../lib/Debug/libhello.so -hello < hello.bc > /dev/null
Hello: __main
Hello: puts
Hello: main

The '-load' option specifies that 'opt' should load your pass as a shared object, which makes '-hello' a valid command line argument (which is one reason you need to register your pass). Because the hello pass does not modify the program in any interesting way, we just throw away the result of opt (sending it to /dev/null).

To see what happened to the other string you registered, try running opt with the --help option:

$ opt -load ../../../lib/Debug/libhello.so --help
OVERVIEW: llvm .bc -> .bc modular optimizer

USAGE: opt [options] <input bytecode>

OPTIONS:
  Optimizations available:
...
    -funcresolve    - Resolve Functions
    -gcse           - Global Common Subexpression Elimination
    -globaldce      - Dead Global Elimination
    -hello          - Hello World Pass
    -indvars        - Cannonicalize Induction Variables
    -inline         - Function Integration/Inlining
    -instcombine    - Combine redundant instructions
...

The pass name get added as the information string for your pass, giving some documentation to users of opt. Now that you have a working pass, you would go ahead and make it do the cool transformations you want. Once you get it all working and tested, it may become useful to find out how fast your pass is. The PassManager provides a nice command line option (--time-passes) that allows you to get information about the execution time of your pass along with the other passes you queue up. For example:

$ opt -load ../../../lib/Debug/libhello.so -hello -time-passes < hello.bc > /dev/null
Hello: __main
Hello: puts
Hello: main
===============================================================================
                      ... Pass execution timing report ...
===============================================================================
  Total Execution Time: 0.02 seconds (0.0479059 wall clock)

   ---User Time---   --System Time--   --User+System--   ---Wall Time---  --- Pass Name ---
   0.0100 (100.0%)   0.0000 (  0.0%)   0.0100 ( 50.0%)   0.0402 ( 84.0%)  Bytecode Writer
   0.0000 (  0.0%)   0.0100 (100.0%)   0.0100 ( 50.0%)   0.0031 (  6.4%)  Dominator Set Construction
   0.0000 (  0.0%)   0.0000 (  0.0%)   0.0000 (  0.0%)   0.0013 (  2.7%)  Module Verifier
   0.0000 (  0.0%)   0.0000 (  0.0%)   0.0000 (  0.0%)   0.0033 (  6.9%)  Hello World Pass
   0.0100 (100.0%)   0.0100 (100.0%)   0.0200 (100.0%)   0.0479 (100.0%)  TOTAL

As you can see, our implementation above is pretty fast :). The additional passes listed are automatically inserted by the 'opt' tool to verify that the LLVM emitted by your pass is still valid and well formed LLVM, which hasn't been broken somehow. Now that you have seen the basics of the mechanics behind passes, we can talk about some more details of how they work and how to use them.

One of the first things that you should do when designing a new pass is to decide what class you should subclass for your pass. The Hello World example uses the FunctionPass class for its implementation, but we did not discuss why or when this should occur. Here we talk about the classes available, from the most general to the most specific.

When choosing a superclass for your Pass, you should choose the most specific class possible, while still being able to meet the requirements listed. This gives the LLVM Pass Infrastructure information neccesary to optimize how passes are run, so that the resultant compiler isn't unneccesarily slow.

The "Pass" class is the most general of all superclasses that you can use. Deriving from Pass indicates that your pass uses the entire program as a unit, refering to function bodies in no predictable order, or adding and removing functions. Because nothing is known about the behavior of direct Pass subclasses, no optimization can be done for their execution.

To write a correct Pass subclass, derive from Pass and overload the run method with the following signature:

---

The run method

  virtual bool run(Module &M) = 0;

The run method performs the interesting work of the pass, and should return true if the module was modified by the transformation, false otherwise.

In contrast to direct Pass subclasses, direct FunctionPass subclasses do have a predictable, local behavior that can be expected by the system. All FunctionPass execute on each function in the program independant of all of the other functions in the program. FunctionPass's do not require that they are executed in a particular order, and FunctionPass's do not modify external functions.

To be explicit, FunctionPass subclasses are not allowed to:

1. Modify a Function other than the one currently being processed.
2. Add or remove Function's from the current Module.
3. Add or remove global variables from the current Module.
4. Maintain state across invocations of runOnFunction (including global data)

Implementing a FunctionPass is usually straightforward (See the Hello World pass for example). FunctionPass's may overload three virtual methods to do their work. All of these methods should return true if they modified the program, or false if they didn't.

---

The doInitialization method

  virtual bool doInitialization(Module &M);

The doIninitialize method is allowed to do most of the things that FunctionPass's are not allowed to do. They can add and remove functions, get pointers to functions, etc. The doInitialize method is designed to do simple initialization type of stuff that does not depend on the functions being processed. The doInitialization function call is not scheduled to overlap with any other pass executions.

A good example of how this method should be used is the LowerAllocations pass. This pass converts malloc and free instructions into platform dependant malloc() and free() function calls. It uses the doInitialization method to get a reference to the malloc and free functions that it needs, adding prototypes to the module if neccesary.

---

The runOnFunction method

  virtual bool runOnFunction(Function &F) = 0;

The runOnFunction method must be implemented by your subclass to do the transformation or analysis work of your pass. As usual, a true value should be returned if the function is modified.

---

The doFinalization method

  virtual bool doFinalization(Module &M);


The doFinalization method is an infrequently used method that is called
when the pass framework has finished calling runOnFunction for every function in the
program being compiled.

BasicBlockPass's are just like FunctionPass's, except that they must limit their scope of inspection and modification to a single basic block at a time. As such, they are not allowed to do any of the following:
1. Modify or inspect any basic blocks outside of the current one
2. Maintain state across invocations of runOnBasicBlock
3. Modify the constrol flow graph (by altering terminator instructions)
4. Any of the things verboten for FunctionPass's.

BasicBlockPass's are useful for traditional local and "peephole" optimizations. They may override the same doInitialization and doFinalization methods that FunctionPass's have, but also have a runOnBasicBlock method:

---

The runOnBasicBlock method

  virtual bool runOnBasicBlock(BasicBlock &BB) = 0;

Override this function to do the work of the BasicBlockPass. This function is not allowed to inspect or modify basic blocks other than the parameter, and are not allowed to modify the CFG. A true value must be returned if the basic block is modified.

In the Hello World example pass we illustrated how pass registration works, and discussed some of the reasons that it is used and what it does. Here we discuss how and why passes are registered.

Passes can be registered in several different ways. Depending on the general classification of the pass, you should use one of the following templates to register the pass:

• RegisterOpt - This template should be used when you are registering a pass that logically should be available for use in the 'opt' utility.

• RegisterAnalysis - This template should be used when you are registering a pass that logically should be available for use in the 'analysis' utility.

• RegisterLLC - This template should be used when you are registering a pass that logically should be available for use in the 'llc' utility.

• RegisterPass - This is the generic form of the Register* templates that should be used if you want your pass listed by multiple or no utilities. This template takes an extra third argument that specifies which tools it should be listed in. See the PassSupport.h file for more information.

Regardless of how you register your pass, you must specify at least two parameters. The first parameter is the name of the pass that is to be used on the command line to specify that the pass should be added to a program (for example opt or analyze). The second argument is the name of the pass, which is to be used for the --help output of programs, as well as for debug output generated by the --debug-pass option.

If you pass is constructed by its default constructor, you only ever have to pass these two arguments. If, on the other hand, you require other information (like target specific information), you must pass an additional argument. This argument is a pointer to a function used to create the pass. For an example of how this works, look at the LowerAllocations.cpp file.

If a pass is registered to be used by the analyze utility, you should implement the virtual print method:

---

The print method

  virtual void print(std::ostream &O, const Module *M) const;

The print method must be implemented by "analyses" in order to print a human readable version of the analysis results. This is useful for debugging an analysis itself, as well as for other people to figure out how an analysis works. The analyze tool uses this method to generate its output.

The ostream parameter specifies the stream to write the results on, and the Module parameter gives a pointer to the top level module of the program that has been analyzed. Note however that this pointer may be null in certain circumstances (such as calling the Pass::dump() from a debugger), so it should only be used to enhance debug output, it should not be depended on.

One of the main responsibilities of the PassManager is the make sure that passes interact with each other correctly. Because PassManager tries to optimize the execution of passes it must know how the passes interact with each other and what dependencies exist between the various passes. To track this, each pass can declare the set of passes that are required to be executed before the current pass, and the passes which are invalidated by the current pass.

Typically this functionality is used to require that analysis results are computed before your pass is run. Running arbitrary transformation passes can invalidate the computed analysis results, which is what the invalidation set specifies. If a pass does not implement the getAnalysisUsage method, it defaults to not having any prerequisite passes, and invalidating all other passes.

---

The getAnalysisUsage method

  virtual void getAnalysisUsage(AnalysisUsage &Info) const;

By implementing the getAnalysisUsage method, the required and invalidated sets may be specified for your transformation. The implementation should fill in the AnalysisUsage object with information about which passes are required and not invalidated. To do this, the following set methods are provided by the AnalysisUsage class:

  // addRequires - Add the specified pass to the required set for your pass.
  template<class PassClass>
  AnalysisUsage &AnalysisUsage::addRequired();

  // addPreserved - Add the specified pass to the set of analyses preserved by
  // this pass
  template<class PassClass>
  AnalysisUsage &AnalysisUsage::addPreserved();

  // setPreservesAll - Call this if the pass does not modify its input at all
  void AnalysisUsage::setPreservesAll();

  // preservesCFG - This function should be called by the pass, iff they do not:
  //
  //  1. Add or remove basic blocks from the function
  //  2. Modify terminator instructions in any way.
  //
  //  This is automatically implied for BasicBlockPass's
  //
  void AnalysisUsage::preservesCFG();

Some examples of how to use these methods are:

  // This is an example implementation from an analysis, which does not modify
  // the program at all, yet has a prerequisite.
  void PostDominanceFrontier::getAnalysisUsage(AnalysisUsage &AU) const {
    AU.setPreservesAll();
    AU.addRequired<PostDominatorTree>();
  }

and:

  // This example modifies the program, but does not modify the CFG
  void LICM::getAnalysisUsage(AnalysisUsage &AU) const {
    AU.preservesCFG();
    AU.addRequired<LoopInfo>();
  }

---

The getAnalysis<> method

The Pass::getAnalysis<> method is inherited by your class, providing you with access to the passes that you declared that you required with the getAnalysisUsage method. It takes a single template argument that specifies which pass class you want, and returns a reference to that pass.

  template<typename PassClass>
  AnalysisType &getAnalysis();

This method call returns a reference to the pass desired. You may get a runtime assertion failure if you attempt to get an analysis that you did not declare as required in your getAnalysisUsage implementation. This method can be called by your run* method implementation, or by any other local method invoked by your run* method.

The PassManager class takes a list of passes, ensures their prerequisites are set up correctly, and then schedules passes to run efficiently. All of the LLVM tools that run passes use the PassManager for execution of these passes.

The PassManager does two main things to try to reduce the execution time of a series of passes:

1. Share analysis results - The PassManager attempts to avoid recomputing analysis results as much as possible. This means keeping track of which analyses are available already, which analyses get invalidated, and which analyses are needed to be run for a pass. An important part of work is that the PassManager tracks the exact lifetime of all analysis results, allowing it to free memory allocated to holding analysis results as soon as they are no longer needed.

2. Pipeline the execution of passes on the program - The PassManager attempts to get better cache and memory usage behavior out of a series of passes by pipelining the passes together. This means that, given a series of consequtive FunctionPass's, it will execute all of the FunctionPass's on the first function, then all of the FunctionPass's on the second function, etc... until the entire program has been run through the passes.

   This improves the cache behavior of the compiler, because it is only touching the LLVM program representation for a single function at a time, instead of traversing the entire program. It reduces the memory consumption of compiler, because, for example, only one DominatorSet needs to be calculated at a time. This also makes it possible some interesting enhancements in the future.

The effectiveness of the PassManager is influenced directly by how much information it has about the behaviors of the passes it is scheduling. For example, the "preserved" set is intentionally conservative in the face of an unimplemented getAnalysisUsage method. Not implementing when it should be implemented will have the effect of not allowing any analysis results to live across the execution of your pass.

The PassManager class exposes a --debug-pass command line options that is useful for debugging pass execution, seeing how things work, and diagnosing when you should be preserving more analyses than you currently are (To get information about all of the variants of the --debug-pass option, just type 'opt --help-hidden').

By using the --debug-pass=Structure option, for example, we can see how our Hello World pass interacts with other passes. Lets try it out with the gcse and licm passes:

$ opt -load ../../../lib/Debug/libhello.so -gcse -licm --debug-pass=Structure < hello.bc > /dev/null
Module Pass Manager
  Function Pass Manager
    Dominator Set Construction
    Immediate Dominators Construction
    Global Common Subexpression Elimination
--  Immediate Dominators Construction
--  Global Common Subexpression Elimination
    Natural Loop Construction
    Loop Invariant Code Motion
--  Natural Loop Construction
--  Loop Invariant Code Motion
    Module Verifier
--  Dominator Set Construction
--  Module Verifier
  Bytecode Writer
--Bytecode Writer

This output shows us when passes are constructed and when the analysis results are known to be dead (prefixed with '--'). Here we see that GCSE uses dominator and immediate dominator information to do its job. The LICM pass uses natural loop information, which uses dominator sets, but not immediate dominators. Because immediate dominators are no longer useful after the GCSE pass, it is immediately destroyed. The dominator sets are then reused to compute natural loop information, which is then used by the LICM pass.

After the LICM pass, the module verifier runs (which is automatically added by the 'opt' tool), which uses the dominator set to check that the resultant LLVM code is well formed. After it finishes, the dominator set information is destroyed, after being computed once, and shared by three passes.

Lets see how this changes when we run the Hello World pass in between the two passes:

$ opt -load ../../../lib/Debug/libhello.so -gcse -hello -licm --debug-pass=Structure < hello.bc > /dev/null
Module Pass Manager
  Function Pass Manager
    Dominator Set Construction
    Immediate Dominators Construction
    Global Common Subexpression Elimination
--  Dominator Set Construction
--  Immediate Dominators Construction
--  Global Common Subexpression Elimination
    Hello World Pass
--  Hello World Pass
    Dominator Set Construction
    Natural Loop Construction
    Loop Invariant Code Motion
--  Natural Loop Construction
--  Loop Invariant Code Motion
    Module Verifier
--  Dominator Set Construction
--  Module Verifier
  Bytecode Writer
--Bytecode Writer
Hello: __main
Hello: puts
Hello: main

Here we see that the Hello World pass has killed the Dominator Set pass, even though it doesn't modify the code at all! To fix this, we need to add the following getAnalysisUsage method to our pass:

    // We don't modify the program, so we preserve all analyses
    virtual void getAnalysisUsage(AnalysisUsage &AU) const {
      AU.setPreservesAll();
    }

Now when we run our pass, we get this output:

$ opt -load ../../../lib/Debug/libhello.so -gcse -hello -licm --debug-pass=Structure < hello.bc > /dev/null
Pass Arguments:  -gcse -hello -licm
Module Pass Manager
  Function Pass Manager
    Dominator Set Construction
    Immediate Dominators Construction
    Global Common Subexpression Elimination
--  Immediate Dominators Construction
--  Global Common Subexpression Elimination
    Hello World Pass
--  Hello World Pass
    Natural Loop Construction
    Loop Invariant Code Motion
--  Loop Invariant Code Motion
--  Natural Loop Construction
    Module Verifier
--  Dominator Set Construction
--  Module Verifier
  Bytecode Writer
--Bytecode Writer
Hello: __main
Hello: puts
Hello: main

Which shows that we don't accidentally invalidate dominator information anymore, and therefore do not have to compute it twice.

---

The releaseMemory method

  virtual void releaseMemory();

The PassManager automatically determines when to compute analysis results, and how long to keep them around for. Because the lifetime of the pass object itself is effectively the entire duration of the compilation process, we need some way to free analysis results when they are no longer useful. The releaseMemory virtual method is the way to do this.

If you are writing an analysis or any other pass that retains a significant amount of state (for use by another pass which "requires" your pass and uses the getAnalysis method) you should implement releaseMEmory to, well, release the memory allocated to maintain this internal state. This method is called after the run* method for the class, before the next call of run* in your pass.

Although the LLVM Pass Infrastructure is very capable as it stands, and does some nifty stuff, there are things we'd like to add in the future. Here is where we are going:

---

Multithreaded LLVM

Multiple CPU machines are becoming more command and compilation can never be fast enough: obviously we should allow for a multithreaded compiler. Because of the semantics defined for passes above (specifically they cannot maintain state across invocations of their run* methods), a nice clean way to implement a multithreaded compiler would be for the PassManager class to create multiple instances of each pass object, and allow the seperate instances to be hacking on different parts of the program at the same time.

This implementation would prevent each of the passes from having to implement multithreaded constructs, requiring only the LLVM core to have locking in a few places (for global resources). Although this is a simple extension, we simply haven't had time (or multiprocessor machines, thus a reason) to implement this. Despite that, we have kept the LLVM passes SMP ready, and you should too.

---

A new ModuleSource interface

Currently, the PassManager's run method takes a Module as input, and runs all of the passes on this module. The problem with this approach is that none of the PassManager features can be used for timing and debugging the actual loading of the module from disk or standard input.

To solve this problem, eventually the PassManger class will accept a ModuleSource object instead of a Module itself. When complete, this will also allow for streaming of functions out of the bytecode representation, allowing us to avoid holding the entire program in memory at once if we only are dealing with FunctionPass's.

As part of a different issue, eventually the bytecode loader will be extended to allow on-demand loading of functions from the bytecode representation, in order to better support the runtime reoptimizer. The bytecode format is already capable of this, the loader just needs to be reworked a bit.

---

Pass's requiring FunctionPass's

Currently it is illegal for a Pass to require a FunctionPass. This is because there is only one instance of the FunctionPass object ever created, thus nowhere to store information for all of the functions in the program at the same time. Although this has come up a couple of times before, this has always been worked around by factoring one big complicated pass into a global and an interprocedural part, both of which are distinct. In the future, it would be nice to have this though.

Note that it is no problem for a FunctionPass to require the results of a Pass, only the other way around.