[LLVMdev] The use-define chain in LLVM

[John Criswell]

On 8/10/12 1:10 AM, Jianfei Hu wrote:
> Yes, this demanding comes from our recent research project.
> If it's avaiable, could you send me the source code of taint-tracking analysis ?
> I really appreciate your help. Thanks!

Hi, all.

Sorry I dropped the ball on this.  I was speaking with our collaborators 
about it and then got busy with other things and forgot about it.

I originally got approval to release a copy to one person; since then, 
I've received another 1 or 2 requests.  I'm double checking with the 
authors to make sure that release to multiple groups is okay (I suspect 
it will be).  Assuming I get approval, I'll have on of our students on 
that project package up the code.

Please feel free to remind me about this if you don't hear from me in 
awhile.  I'm juggling several tasks at the moment.

-- John T.

>
> 2012/8/9 John Criswell <criswell at illinois.edu>:
>> On 8/9/12 12:40 AM, Jianfei Hu wrote:
>>> Maybe My statement is not clear. Take an example:
>>> main.c:
>>> int global;
>>> void fun(int array[], int i){
>>>          array[i] = i + 1;
>>>           global = i;
>>> }
>>>
>>> int main(){
>>>          int arr[40], i = 0;
>>>          fun(arr, 10);
>>>          return 0;
>>> }
>>> Can I determine whether the value of arr array and global variable
>>> have changed after the function call, fun(arr, 10), by LLVM API? It
>>> could be more complicated considerring the nested function call, and
>>> variable pointer alias. Does LLVM offer the interface to solve that?
>>
>> If you need to compute use-def chains for values that are not in SSA form
>> (basically anything that is accessed via LLVM load and store instructions),
>> then you'll need to implement your own data-flow analysis to compute the
>> reaching definitions using some memory-based abstraction.
>>
>> There is a points-to analysis for LLVM called DSA within the poolalloc
>> project.  It creates a graph of nodes (called DSNodes) which represent
>> abstract memory locations.  You could use that to implement a use/def
>> analysis that works on global variables, stack objects, and heap objects.
>>
>> You can get poolalloc using the command svn co
>> http://llvm.org/svn/llvm-project/poolalloc/trunk poolalloc
>>
>> As an FYI, one of our collaborators recently gave us permission to give
>> someone the source code for a taint-tracking analysis which is similar to
>> reaching definitions analysis.  If you want, I can ask if we can give you a
>> copy of it, too.  I assume it's for a research project, correct?
>>
>> -- John T.
>>
>>
>>> 2012/8/9 Alex Rønne Petersen <xtzgzorex at gmail.com>:
>>>> On Thu, Aug 9, 2012 at 6:57 AM, Jianfei Hu <hujianfei258 at gmail.com>
>>>> wrote:
>>>>> Thanks for your response!
>>>>>
>>>>> But I want to determine wheter the specific variable's value has been
>>>>> changed between
>>>>> two usages of variable, and wheter the parameter's value is changed in
>>>>> a function. Like the
>>>>> reaching definition analysis, and ud chains.
>>>>>
>>>>>
>>>>> 2012/8/9 陳韋任 (Wei-Ren Chen) <chenwj at iis.sinica.edu.tw>:
>>>>>> On Thu, Aug 09, 2012 at 11:16:15AM +0800, Jianfei Hu wrote:
>>>>>>> Hello All,
>>>>>>>
>>>>>>>           Is the use-define chain related API avaliable in LLVM? I want
>>>>>>> to get the information
>>>>>>> about the variables' value changes at different points in the program.
>>>>>>     Is this [1] fit your need?
>>>>>>
>>>>>> HTH,
>>>>>> chenwj
>>>>>>
>>>>>> [1] http://llvm.org/docs/ProgrammersManual.html#iterate_chains
>>>>> This just supplys the variables used by the one instruction.
>>>>> Is there any other class/API that can meet my demands?
>>>>> Or I have to implement it by myself from the llvm IR code?
>>>>>
>>>>>> --
>>>>>> Wei-Ren Chen (陳韋任)
>>>>>> Computer Systems Lab, Institute of Information Science,
>>>>>> Academia Sinica, Taiwan (R.O.C.)
>>>>>> Tel:886-2-2788-3799 #1667
>>>>>> Homepage: http://people.cs.nctu.edu.tw/~chenwj
>>>>>
>>>>> _______________________________________________
>>>>> LLVM Developers mailing list
>>>>> LLVMdev at cs.uiuc.edu         http://llvm.cs.uiuc.edu
>>>>> http://lists.cs.uiuc.edu/mailman/listinfo/llvmdev
>>>>>
>>>> I don't know how low-level you plan to work at, but at the LLVM IR
>>> Do you mean the LLVM could generate a higher level representative,
>>> instead of IR, like AST? I just know the IR code level.
>>>
>>>> level, a register can only be defined once (LLVM IR is in SSA form),
>>>> so while a register can have multiple uses, it can only have one
>>>> definition (or none, in the case of registers that aren't
>>>> initialized).
>>>>
>>>> Regards,
>>>> Alex
>>> _______________________________________________
>>> LLVM Developers mailing list
>>> LLVMdev at cs.uiuc.edu         http://llvm.cs.uiuc.edu
>>> http://lists.cs.uiuc.edu/mailman/listinfo/llvmdev
>>