1 //===- GlobalsModRef.cpp - Simple Mod/Ref Analysis for Globals ------------===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This simple pass provides alias and mod/ref information for global values 11 // that do not have their address taken, and keeps track of whether functions 12 // read or write memory (are "pure"). For this simple (but very common) case, 13 // we can provide pretty accurate and useful information. 14 // 15 //===----------------------------------------------------------------------===// 16 17 #include "llvm/Analysis/GlobalsModRef.h" 18 #include "llvm/ADT/SCCIterator.h" 19 #include "llvm/ADT/SmallPtrSet.h" 20 #include "llvm/ADT/Statistic.h" 21 #include "llvm/Analysis/MemoryBuiltins.h" 22 #include "llvm/Analysis/TargetLibraryInfo.h" 23 #include "llvm/Analysis/ValueTracking.h" 24 #include "llvm/IR/DerivedTypes.h" 25 #include "llvm/IR/InstIterator.h" 26 #include "llvm/IR/Instructions.h" 27 #include "llvm/IR/IntrinsicInst.h" 28 #include "llvm/IR/Module.h" 29 #include "llvm/Pass.h" 30 #include "llvm/Support/CommandLine.h" 31 using namespace llvm; 32 33 #define DEBUG_TYPE "globalsmodref-aa" 34 35 STATISTIC(NumNonAddrTakenGlobalVars, 36 "Number of global vars without address taken"); 37 STATISTIC(NumNonAddrTakenFunctions,"Number of functions without address taken"); 38 STATISTIC(NumNoMemFunctions, "Number of functions that do not access memory"); 39 STATISTIC(NumReadMemFunctions, "Number of functions that only read memory"); 40 STATISTIC(NumIndirectGlobalVars, "Number of indirect global objects"); 41 42 // An option to enable unsafe alias results from the GlobalsModRef analysis. 43 // When enabled, GlobalsModRef will provide no-alias results which in extremely 44 // rare cases may not be conservatively correct. In particular, in the face of 45 // transforms which cause assymetry between how effective GetUnderlyingObject 46 // is for two pointers, it may produce incorrect results. 47 // 48 // These unsafe results have been returned by GMR for many years without 49 // causing significant issues in the wild and so we provide a mechanism to 50 // re-enable them for users of LLVM that have a particular performance 51 // sensitivity and no known issues. The option also makes it easy to evaluate 52 // the performance impact of these results. 53 static cl::opt<bool> EnableUnsafeGlobalsModRefAliasResults( 54 "enable-unsafe-globalsmodref-alias-results", cl::init(false), cl::Hidden); 55 56 /// The mod/ref information collected for a particular function. 57 /// 58 /// We collect information about mod/ref behavior of a function here, both in 59 /// general and as pertains to specific globals. We only have this detailed 60 /// information when we know *something* useful about the behavior. If we 61 /// saturate to fully general mod/ref, we remove the info for the function. 62 class GlobalsAAResult::FunctionInfo { 63 typedef SmallDenseMap<const GlobalValue *, ModRefInfo, 16> GlobalInfoMapType; 64 65 /// Build a wrapper struct that has 8-byte alignment. All heap allocations 66 /// should provide this much alignment at least, but this makes it clear we 67 /// specifically rely on this amount of alignment. 68 struct LLVM_ALIGNAS(8) AlignedMap { 69 AlignedMap() {} 70 AlignedMap(const AlignedMap &Arg) : Map(Arg.Map) {} 71 GlobalInfoMapType Map; 72 }; 73 74 /// Pointer traits for our aligned map. 75 struct AlignedMapPointerTraits { 76 static inline void *getAsVoidPointer(AlignedMap *P) { return P; } 77 static inline AlignedMap *getFromVoidPointer(void *P) { 78 return (AlignedMap *)P; 79 } 80 enum { NumLowBitsAvailable = 3 }; 81 static_assert(AlignOf<AlignedMap>::Alignment >= (1 << NumLowBitsAvailable), 82 "AlignedMap insufficiently aligned to have enough low bits."); 83 }; 84 85 /// The bit that flags that this function may read any global. This is 86 /// chosen to mix together with ModRefInfo bits. 87 enum { MayReadAnyGlobal = 4 }; 88 89 /// Checks to document the invariants of the bit packing here. 90 static_assert((MayReadAnyGlobal & MRI_ModRef) == 0, 91 "ModRef and the MayReadAnyGlobal flag bits overlap."); 92 static_assert(((MayReadAnyGlobal | MRI_ModRef) >> 93 AlignedMapPointerTraits::NumLowBitsAvailable) == 0, 94 "Insufficient low bits to store our flag and ModRef info."); 95 96 public: 97 FunctionInfo() : Info() {} 98 ~FunctionInfo() { 99 delete Info.getPointer(); 100 } 101 // Spell out the copy ond move constructors and assignment operators to get 102 // deep copy semantics and correct move semantics in the face of the 103 // pointer-int pair. 104 FunctionInfo(const FunctionInfo &Arg) 105 : Info(nullptr, Arg.Info.getInt()) { 106 if (const auto *ArgPtr = Arg.Info.getPointer()) 107 Info.setPointer(new AlignedMap(*ArgPtr)); 108 } 109 FunctionInfo(FunctionInfo &&Arg) 110 : Info(Arg.Info.getPointer(), Arg.Info.getInt()) { 111 Arg.Info.setPointerAndInt(nullptr, 0); 112 } 113 FunctionInfo &operator=(const FunctionInfo &RHS) { 114 delete Info.getPointer(); 115 Info.setPointerAndInt(nullptr, RHS.Info.getInt()); 116 if (const auto *RHSPtr = RHS.Info.getPointer()) 117 Info.setPointer(new AlignedMap(*RHSPtr)); 118 return *this; 119 } 120 FunctionInfo &operator=(FunctionInfo &&RHS) { 121 delete Info.getPointer(); 122 Info.setPointerAndInt(RHS.Info.getPointer(), RHS.Info.getInt()); 123 RHS.Info.setPointerAndInt(nullptr, 0); 124 return *this; 125 } 126 127 /// Returns the \c ModRefInfo info for this function. 128 ModRefInfo getModRefInfo() const { 129 return ModRefInfo(Info.getInt() & MRI_ModRef); 130 } 131 132 /// Adds new \c ModRefInfo for this function to its state. 133 void addModRefInfo(ModRefInfo NewMRI) { 134 Info.setInt(Info.getInt() | NewMRI); 135 } 136 137 /// Returns whether this function may read any global variable, and we don't 138 /// know which global. 139 bool mayReadAnyGlobal() const { return Info.getInt() & MayReadAnyGlobal; } 140 141 /// Sets this function as potentially reading from any global. 142 void setMayReadAnyGlobal() { Info.setInt(Info.getInt() | MayReadAnyGlobal); } 143 144 /// Returns the \c ModRefInfo info for this function w.r.t. a particular 145 /// global, which may be more precise than the general information above. 146 ModRefInfo getModRefInfoForGlobal(const GlobalValue &GV) const { 147 ModRefInfo GlobalMRI = mayReadAnyGlobal() ? MRI_Ref : MRI_NoModRef; 148 if (AlignedMap *P = Info.getPointer()) { 149 auto I = P->Map.find(&GV); 150 if (I != P->Map.end()) 151 GlobalMRI = ModRefInfo(GlobalMRI | I->second); 152 } 153 return GlobalMRI; 154 } 155 156 /// Add mod/ref info from another function into ours, saturating towards 157 /// MRI_ModRef. 158 void addFunctionInfo(const FunctionInfo &FI) { 159 addModRefInfo(FI.getModRefInfo()); 160 161 if (FI.mayReadAnyGlobal()) 162 setMayReadAnyGlobal(); 163 164 if (AlignedMap *P = FI.Info.getPointer()) 165 for (const auto &G : P->Map) 166 addModRefInfoForGlobal(*G.first, G.second); 167 } 168 169 void addModRefInfoForGlobal(const GlobalValue &GV, ModRefInfo NewMRI) { 170 AlignedMap *P = Info.getPointer(); 171 if (!P) { 172 P = new AlignedMap(); 173 Info.setPointer(P); 174 } 175 auto &GlobalMRI = P->Map[&GV]; 176 GlobalMRI = ModRefInfo(GlobalMRI | NewMRI); 177 } 178 179 /// Clear a global's ModRef info. Should be used when a global is being 180 /// deleted. 181 void eraseModRefInfoForGlobal(const GlobalValue &GV) { 182 if (AlignedMap *P = Info.getPointer()) 183 P->Map.erase(&GV); 184 } 185 186 private: 187 /// All of the information is encoded into a single pointer, with a three bit 188 /// integer in the low three bits. The high bit provides a flag for when this 189 /// function may read any global. The low two bits are the ModRefInfo. And 190 /// the pointer, when non-null, points to a map from GlobalValue to 191 /// ModRefInfo specific to that GlobalValue. 192 PointerIntPair<AlignedMap *, 3, unsigned, AlignedMapPointerTraits> Info; 193 }; 194 195 void GlobalsAAResult::DeletionCallbackHandle::deleted() { 196 Value *V = getValPtr(); 197 if (auto *F = dyn_cast<Function>(V)) 198 GAR->FunctionInfos.erase(F); 199 200 if (GlobalValue *GV = dyn_cast<GlobalValue>(V)) { 201 if (GAR->NonAddressTakenGlobals.erase(GV)) { 202 // This global might be an indirect global. If so, remove it and 203 // remove any AllocRelatedValues for it. 204 if (GAR->IndirectGlobals.erase(GV)) { 205 // Remove any entries in AllocsForIndirectGlobals for this global. 206 for (auto I = GAR->AllocsForIndirectGlobals.begin(), 207 E = GAR->AllocsForIndirectGlobals.end(); 208 I != E; ++I) 209 if (I->second == GV) 210 GAR->AllocsForIndirectGlobals.erase(I); 211 } 212 213 // Scan the function info we have collected and remove this global 214 // from all of them. 215 for (auto &FIPair : GAR->FunctionInfos) 216 FIPair.second.eraseModRefInfoForGlobal(*GV); 217 } 218 } 219 220 // If this is an allocation related to an indirect global, remove it. 221 GAR->AllocsForIndirectGlobals.erase(V); 222 223 // And clear out the handle. 224 setValPtr(nullptr); 225 GAR->Handles.erase(I); 226 // This object is now destroyed! 227 } 228 229 FunctionModRefBehavior GlobalsAAResult::getModRefBehavior(const Function *F) { 230 FunctionModRefBehavior Min = FMRB_UnknownModRefBehavior; 231 232 if (FunctionInfo *FI = getFunctionInfo(F)) { 233 if (FI->getModRefInfo() == MRI_NoModRef) 234 Min = FMRB_DoesNotAccessMemory; 235 else if ((FI->getModRefInfo() & MRI_Mod) == 0) 236 Min = FMRB_OnlyReadsMemory; 237 } 238 239 return FunctionModRefBehavior(AAResultBase::getModRefBehavior(F) & Min); 240 } 241 242 FunctionModRefBehavior 243 GlobalsAAResult::getModRefBehavior(ImmutableCallSite CS) { 244 FunctionModRefBehavior Min = FMRB_UnknownModRefBehavior; 245 246 if (!CS.hasOperandBundles()) 247 if (const Function *F = CS.getCalledFunction()) 248 if (FunctionInfo *FI = getFunctionInfo(F)) { 249 if (FI->getModRefInfo() == MRI_NoModRef) 250 Min = FMRB_DoesNotAccessMemory; 251 else if ((FI->getModRefInfo() & MRI_Mod) == 0) 252 Min = FMRB_OnlyReadsMemory; 253 } 254 255 return FunctionModRefBehavior(AAResultBase::getModRefBehavior(CS) & Min); 256 } 257 258 /// Returns the function info for the function, or null if we don't have 259 /// anything useful to say about it. 260 GlobalsAAResult::FunctionInfo * 261 GlobalsAAResult::getFunctionInfo(const Function *F) { 262 auto I = FunctionInfos.find(F); 263 if (I != FunctionInfos.end()) 264 return &I->second; 265 return nullptr; 266 } 267 268 /// AnalyzeGlobals - Scan through the users of all of the internal 269 /// GlobalValue's in the program. If none of them have their "address taken" 270 /// (really, their address passed to something nontrivial), record this fact, 271 /// and record the functions that they are used directly in. 272 void GlobalsAAResult::AnalyzeGlobals(Module &M) { 273 SmallPtrSet<Function *, 32> TrackedFunctions; 274 for (Function &F : M) 275 if (F.hasLocalLinkage()) 276 if (!AnalyzeUsesOfPointer(&F)) { 277 // Remember that we are tracking this global. 278 NonAddressTakenGlobals.insert(&F); 279 TrackedFunctions.insert(&F); 280 Handles.emplace_front(*this, &F); 281 Handles.front().I = Handles.begin(); 282 ++NumNonAddrTakenFunctions; 283 } 284 285 SmallPtrSet<Function *, 16> Readers, Writers; 286 for (GlobalVariable &GV : M.globals()) 287 if (GV.hasLocalLinkage()) { 288 if (!AnalyzeUsesOfPointer(&GV, &Readers, 289 GV.isConstant() ? nullptr : &Writers)) { 290 // Remember that we are tracking this global, and the mod/ref fns 291 NonAddressTakenGlobals.insert(&GV); 292 Handles.emplace_front(*this, &GV); 293 Handles.front().I = Handles.begin(); 294 295 for (Function *Reader : Readers) { 296 if (TrackedFunctions.insert(Reader).second) { 297 Handles.emplace_front(*this, Reader); 298 Handles.front().I = Handles.begin(); 299 } 300 FunctionInfos[Reader].addModRefInfoForGlobal(GV, MRI_Ref); 301 } 302 303 if (!GV.isConstant()) // No need to keep track of writers to constants 304 for (Function *Writer : Writers) { 305 if (TrackedFunctions.insert(Writer).second) { 306 Handles.emplace_front(*this, Writer); 307 Handles.front().I = Handles.begin(); 308 } 309 FunctionInfos[Writer].addModRefInfoForGlobal(GV, MRI_Mod); 310 } 311 ++NumNonAddrTakenGlobalVars; 312 313 // If this global holds a pointer type, see if it is an indirect global. 314 if (GV.getValueType()->isPointerTy() && 315 AnalyzeIndirectGlobalMemory(&GV)) 316 ++NumIndirectGlobalVars; 317 } 318 Readers.clear(); 319 Writers.clear(); 320 } 321 } 322 323 /// AnalyzeUsesOfPointer - Look at all of the users of the specified pointer. 324 /// If this is used by anything complex (i.e., the address escapes), return 325 /// true. Also, while we are at it, keep track of those functions that read and 326 /// write to the value. 327 /// 328 /// If OkayStoreDest is non-null, stores into this global are allowed. 329 bool GlobalsAAResult::AnalyzeUsesOfPointer(Value *V, 330 SmallPtrSetImpl<Function *> *Readers, 331 SmallPtrSetImpl<Function *> *Writers, 332 GlobalValue *OkayStoreDest) { 333 if (!V->getType()->isPointerTy()) 334 return true; 335 336 for (Use &U : V->uses()) { 337 User *I = U.getUser(); 338 if (LoadInst *LI = dyn_cast<LoadInst>(I)) { 339 if (Readers) 340 Readers->insert(LI->getParent()->getParent()); 341 } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) { 342 if (V == SI->getOperand(1)) { 343 if (Writers) 344 Writers->insert(SI->getParent()->getParent()); 345 } else if (SI->getOperand(1) != OkayStoreDest) { 346 return true; // Storing the pointer 347 } 348 } else if (Operator::getOpcode(I) == Instruction::GetElementPtr) { 349 if (AnalyzeUsesOfPointer(I, Readers, Writers)) 350 return true; 351 } else if (Operator::getOpcode(I) == Instruction::BitCast) { 352 if (AnalyzeUsesOfPointer(I, Readers, Writers, OkayStoreDest)) 353 return true; 354 } else if (auto CS = CallSite(I)) { 355 // Make sure that this is just the function being called, not that it is 356 // passing into the function. 357 if (CS.isDataOperand(&U)) { 358 // Detect calls to free. 359 if (CS.isArgOperand(&U) && isFreeCall(I, &TLI)) { 360 if (Writers) 361 Writers->insert(CS->getParent()->getParent()); 362 } else { 363 return true; // Argument of an unknown call. 364 } 365 } 366 } else if (ICmpInst *ICI = dyn_cast<ICmpInst>(I)) { 367 if (!isa<ConstantPointerNull>(ICI->getOperand(1))) 368 return true; // Allow comparison against null. 369 } else { 370 return true; 371 } 372 } 373 374 return false; 375 } 376 377 /// AnalyzeIndirectGlobalMemory - We found an non-address-taken global variable 378 /// which holds a pointer type. See if the global always points to non-aliased 379 /// heap memory: that is, all initializers of the globals are allocations, and 380 /// those allocations have no use other than initialization of the global. 381 /// Further, all loads out of GV must directly use the memory, not store the 382 /// pointer somewhere. If this is true, we consider the memory pointed to by 383 /// GV to be owned by GV and can disambiguate other pointers from it. 384 bool GlobalsAAResult::AnalyzeIndirectGlobalMemory(GlobalVariable *GV) { 385 // Keep track of values related to the allocation of the memory, f.e. the 386 // value produced by the malloc call and any casts. 387 std::vector<Value *> AllocRelatedValues; 388 389 // If the initializer is a valid pointer, bail. 390 if (Constant *C = GV->getInitializer()) 391 if (!C->isNullValue()) 392 return false; 393 394 // Walk the user list of the global. If we find anything other than a direct 395 // load or store, bail out. 396 for (User *U : GV->users()) { 397 if (LoadInst *LI = dyn_cast<LoadInst>(U)) { 398 // The pointer loaded from the global can only be used in simple ways: 399 // we allow addressing of it and loading storing to it. We do *not* allow 400 // storing the loaded pointer somewhere else or passing to a function. 401 if (AnalyzeUsesOfPointer(LI)) 402 return false; // Loaded pointer escapes. 403 // TODO: Could try some IP mod/ref of the loaded pointer. 404 } else if (StoreInst *SI = dyn_cast<StoreInst>(U)) { 405 // Storing the global itself. 406 if (SI->getOperand(0) == GV) 407 return false; 408 409 // If storing the null pointer, ignore it. 410 if (isa<ConstantPointerNull>(SI->getOperand(0))) 411 continue; 412 413 // Check the value being stored. 414 Value *Ptr = GetUnderlyingObject(SI->getOperand(0), 415 GV->getParent()->getDataLayout()); 416 417 if (!isAllocLikeFn(Ptr, &TLI)) 418 return false; // Too hard to analyze. 419 420 // Analyze all uses of the allocation. If any of them are used in a 421 // non-simple way (e.g. stored to another global) bail out. 422 if (AnalyzeUsesOfPointer(Ptr, /*Readers*/ nullptr, /*Writers*/ nullptr, 423 GV)) 424 return false; // Loaded pointer escapes. 425 426 // Remember that this allocation is related to the indirect global. 427 AllocRelatedValues.push_back(Ptr); 428 } else { 429 // Something complex, bail out. 430 return false; 431 } 432 } 433 434 // Okay, this is an indirect global. Remember all of the allocations for 435 // this global in AllocsForIndirectGlobals. 436 while (!AllocRelatedValues.empty()) { 437 AllocsForIndirectGlobals[AllocRelatedValues.back()] = GV; 438 Handles.emplace_front(*this, AllocRelatedValues.back()); 439 Handles.front().I = Handles.begin(); 440 AllocRelatedValues.pop_back(); 441 } 442 IndirectGlobals.insert(GV); 443 Handles.emplace_front(*this, GV); 444 Handles.front().I = Handles.begin(); 445 return true; 446 } 447 448 void GlobalsAAResult::CollectSCCMembership(CallGraph &CG) { 449 // We do a bottom-up SCC traversal of the call graph. In other words, we 450 // visit all callees before callers (leaf-first). 451 unsigned SCCID = 0; 452 for (scc_iterator<CallGraph *> I = scc_begin(&CG); !I.isAtEnd(); ++I) { 453 const std::vector<CallGraphNode *> &SCC = *I; 454 assert(!SCC.empty() && "SCC with no functions?"); 455 456 for (auto *CGN : SCC) 457 if (Function *F = CGN->getFunction()) 458 FunctionToSCCMap[F] = SCCID; 459 ++SCCID; 460 } 461 } 462 463 /// AnalyzeCallGraph - At this point, we know the functions where globals are 464 /// immediately stored to and read from. Propagate this information up the call 465 /// graph to all callers and compute the mod/ref info for all memory for each 466 /// function. 467 void GlobalsAAResult::AnalyzeCallGraph(CallGraph &CG, Module &M) { 468 // We do a bottom-up SCC traversal of the call graph. In other words, we 469 // visit all callees before callers (leaf-first). 470 for (scc_iterator<CallGraph *> I = scc_begin(&CG); !I.isAtEnd(); ++I) { 471 const std::vector<CallGraphNode *> &SCC = *I; 472 assert(!SCC.empty() && "SCC with no functions?"); 473 474 if (!SCC[0]->getFunction() || !SCC[0]->getFunction()->isDefinitionExact()) { 475 // Calls externally or not exact - can't say anything useful. Remove any 476 // existing function records (may have been created when scanning 477 // globals). 478 for (auto *Node : SCC) 479 FunctionInfos.erase(Node->getFunction()); 480 continue; 481 } 482 483 FunctionInfo &FI = FunctionInfos[SCC[0]->getFunction()]; 484 bool KnowNothing = false; 485 486 // Collect the mod/ref properties due to called functions. We only compute 487 // one mod-ref set. 488 for (unsigned i = 0, e = SCC.size(); i != e && !KnowNothing; ++i) { 489 Function *F = SCC[i]->getFunction(); 490 if (!F) { 491 KnowNothing = true; 492 break; 493 } 494 495 if (F->isDeclaration()) { 496 // Try to get mod/ref behaviour from function attributes. 497 if (F->doesNotAccessMemory()) { 498 // Can't do better than that! 499 } else if (F->onlyReadsMemory()) { 500 FI.addModRefInfo(MRI_Ref); 501 if (!F->isIntrinsic() && !F->onlyAccessesArgMemory()) 502 // This function might call back into the module and read a global - 503 // consider every global as possibly being read by this function. 504 FI.setMayReadAnyGlobal(); 505 } else { 506 FI.addModRefInfo(MRI_ModRef); 507 // Can't say anything useful unless it's an intrinsic - they don't 508 // read or write global variables of the kind considered here. 509 KnowNothing = !F->isIntrinsic(); 510 } 511 continue; 512 } 513 514 for (CallGraphNode::iterator CI = SCC[i]->begin(), E = SCC[i]->end(); 515 CI != E && !KnowNothing; ++CI) 516 if (Function *Callee = CI->second->getFunction()) { 517 if (FunctionInfo *CalleeFI = getFunctionInfo(Callee)) { 518 // Propagate function effect up. 519 FI.addFunctionInfo(*CalleeFI); 520 } else { 521 // Can't say anything about it. However, if it is inside our SCC, 522 // then nothing needs to be done. 523 CallGraphNode *CalleeNode = CG[Callee]; 524 if (std::find(SCC.begin(), SCC.end(), CalleeNode) == SCC.end()) 525 KnowNothing = true; 526 } 527 } else { 528 KnowNothing = true; 529 } 530 } 531 532 // If we can't say anything useful about this SCC, remove all SCC functions 533 // from the FunctionInfos map. 534 if (KnowNothing) { 535 for (auto *Node : SCC) 536 FunctionInfos.erase(Node->getFunction()); 537 continue; 538 } 539 540 // Scan the function bodies for explicit loads or stores. 541 for (auto *Node : SCC) { 542 if (FI.getModRefInfo() == MRI_ModRef) 543 break; // The mod/ref lattice saturates here. 544 for (Instruction &I : instructions(Node->getFunction())) { 545 if (FI.getModRefInfo() == MRI_ModRef) 546 break; // The mod/ref lattice saturates here. 547 548 // We handle calls specially because the graph-relevant aspects are 549 // handled above. 550 if (auto CS = CallSite(&I)) { 551 if (isAllocationFn(&I, &TLI) || isFreeCall(&I, &TLI)) { 552 // FIXME: It is completely unclear why this is necessary and not 553 // handled by the above graph code. 554 FI.addModRefInfo(MRI_ModRef); 555 } else if (Function *Callee = CS.getCalledFunction()) { 556 // The callgraph doesn't include intrinsic calls. 557 if (Callee->isIntrinsic()) { 558 FunctionModRefBehavior Behaviour = 559 AAResultBase::getModRefBehavior(Callee); 560 FI.addModRefInfo(ModRefInfo(Behaviour & MRI_ModRef)); 561 } 562 } 563 continue; 564 } 565 566 // All non-call instructions we use the primary predicates for whether 567 // thay read or write memory. 568 if (I.mayReadFromMemory()) 569 FI.addModRefInfo(MRI_Ref); 570 if (I.mayWriteToMemory()) 571 FI.addModRefInfo(MRI_Mod); 572 } 573 } 574 575 if ((FI.getModRefInfo() & MRI_Mod) == 0) 576 ++NumReadMemFunctions; 577 if (FI.getModRefInfo() == MRI_NoModRef) 578 ++NumNoMemFunctions; 579 580 // Finally, now that we know the full effect on this SCC, clone the 581 // information to each function in the SCC. 582 // FI is a reference into FunctionInfos, so copy it now so that it doesn't 583 // get invalidated if DenseMap decides to re-hash. 584 FunctionInfo CachedFI = FI; 585 for (unsigned i = 1, e = SCC.size(); i != e; ++i) 586 FunctionInfos[SCC[i]->getFunction()] = CachedFI; 587 } 588 } 589 590 // GV is a non-escaping global. V is a pointer address that has been loaded from. 591 // If we can prove that V must escape, we can conclude that a load from V cannot 592 // alias GV. 593 static bool isNonEscapingGlobalNoAliasWithLoad(const GlobalValue *GV, 594 const Value *V, 595 int &Depth, 596 const DataLayout &DL) { 597 SmallPtrSet<const Value *, 8> Visited; 598 SmallVector<const Value *, 8> Inputs; 599 Visited.insert(V); 600 Inputs.push_back(V); 601 do { 602 const Value *Input = Inputs.pop_back_val(); 603 604 if (isa<GlobalValue>(Input) || isa<Argument>(Input) || isa<CallInst>(Input) || 605 isa<InvokeInst>(Input)) 606 // Arguments to functions or returns from functions are inherently 607 // escaping, so we can immediately classify those as not aliasing any 608 // non-addr-taken globals. 609 // 610 // (Transitive) loads from a global are also safe - if this aliased 611 // another global, its address would escape, so no alias. 612 continue; 613 614 // Recurse through a limited number of selects, loads and PHIs. This is an 615 // arbitrary depth of 4, lower numbers could be used to fix compile time 616 // issues if needed, but this is generally expected to be only be important 617 // for small depths. 618 if (++Depth > 4) 619 return false; 620 621 if (auto *LI = dyn_cast<LoadInst>(Input)) { 622 Inputs.push_back(GetUnderlyingObject(LI->getPointerOperand(), DL)); 623 continue; 624 } 625 if (auto *SI = dyn_cast<SelectInst>(Input)) { 626 const Value *LHS = GetUnderlyingObject(SI->getTrueValue(), DL); 627 const Value *RHS = GetUnderlyingObject(SI->getFalseValue(), DL); 628 if (Visited.insert(LHS).second) 629 Inputs.push_back(LHS); 630 if (Visited.insert(RHS).second) 631 Inputs.push_back(RHS); 632 continue; 633 } 634 if (auto *PN = dyn_cast<PHINode>(Input)) { 635 for (const Value *Op : PN->incoming_values()) { 636 Op = GetUnderlyingObject(Op, DL); 637 if (Visited.insert(Op).second) 638 Inputs.push_back(Op); 639 } 640 continue; 641 } 642 643 return false; 644 } while (!Inputs.empty()); 645 646 // All inputs were known to be no-alias. 647 return true; 648 } 649 650 // There are particular cases where we can conclude no-alias between 651 // a non-addr-taken global and some other underlying object. Specifically, 652 // a non-addr-taken global is known to not be escaped from any function. It is 653 // also incorrect for a transformation to introduce an escape of a global in 654 // a way that is observable when it was not there previously. One function 655 // being transformed to introduce an escape which could possibly be observed 656 // (via loading from a global or the return value for example) within another 657 // function is never safe. If the observation is made through non-atomic 658 // operations on different threads, it is a data-race and UB. If the 659 // observation is well defined, by being observed the transformation would have 660 // changed program behavior by introducing the observed escape, making it an 661 // invalid transform. 662 // 663 // This property does require that transformations which *temporarily* escape 664 // a global that was not previously escaped, prior to restoring it, cannot rely 665 // on the results of GMR::alias. This seems a reasonable restriction, although 666 // currently there is no way to enforce it. There is also no realistic 667 // optimization pass that would make this mistake. The closest example is 668 // a transformation pass which does reg2mem of SSA values but stores them into 669 // global variables temporarily before restoring the global variable's value. 670 // This could be useful to expose "benign" races for example. However, it seems 671 // reasonable to require that a pass which introduces escapes of global 672 // variables in this way to either not trust AA results while the escape is 673 // active, or to be forced to operate as a module pass that cannot co-exist 674 // with an alias analysis such as GMR. 675 bool GlobalsAAResult::isNonEscapingGlobalNoAlias(const GlobalValue *GV, 676 const Value *V) { 677 // In order to know that the underlying object cannot alias the 678 // non-addr-taken global, we must know that it would have to be an escape. 679 // Thus if the underlying object is a function argument, a load from 680 // a global, or the return of a function, it cannot alias. We can also 681 // recurse through PHI nodes and select nodes provided all of their inputs 682 // resolve to one of these known-escaping roots. 683 SmallPtrSet<const Value *, 8> Visited; 684 SmallVector<const Value *, 8> Inputs; 685 Visited.insert(V); 686 Inputs.push_back(V); 687 int Depth = 0; 688 do { 689 const Value *Input = Inputs.pop_back_val(); 690 691 if (auto *InputGV = dyn_cast<GlobalValue>(Input)) { 692 // If one input is the very global we're querying against, then we can't 693 // conclude no-alias. 694 if (InputGV == GV) 695 return false; 696 697 // Distinct GlobalVariables never alias, unless overriden or zero-sized. 698 // FIXME: The condition can be refined, but be conservative for now. 699 auto *GVar = dyn_cast<GlobalVariable>(GV); 700 auto *InputGVar = dyn_cast<GlobalVariable>(InputGV); 701 if (GVar && InputGVar && 702 !GVar->isDeclaration() && !InputGVar->isDeclaration() && 703 !GVar->isInterposable() && !InputGVar->isInterposable()) { 704 Type *GVType = GVar->getInitializer()->getType(); 705 Type *InputGVType = InputGVar->getInitializer()->getType(); 706 if (GVType->isSized() && InputGVType->isSized() && 707 (DL.getTypeAllocSize(GVType) > 0) && 708 (DL.getTypeAllocSize(InputGVType) > 0)) 709 continue; 710 } 711 712 // Conservatively return false, even though we could be smarter 713 // (e.g. look through GlobalAliases). 714 return false; 715 } 716 717 if (isa<Argument>(Input) || isa<CallInst>(Input) || 718 isa<InvokeInst>(Input)) { 719 // Arguments to functions or returns from functions are inherently 720 // escaping, so we can immediately classify those as not aliasing any 721 // non-addr-taken globals. 722 continue; 723 } 724 725 // Recurse through a limited number of selects, loads and PHIs. This is an 726 // arbitrary depth of 4, lower numbers could be used to fix compile time 727 // issues if needed, but this is generally expected to be only be important 728 // for small depths. 729 if (++Depth > 4) 730 return false; 731 732 if (auto *LI = dyn_cast<LoadInst>(Input)) { 733 // A pointer loaded from a global would have been captured, and we know 734 // that the global is non-escaping, so no alias. 735 const Value *Ptr = GetUnderlyingObject(LI->getPointerOperand(), DL); 736 if (isNonEscapingGlobalNoAliasWithLoad(GV, Ptr, Depth, DL)) 737 // The load does not alias with GV. 738 continue; 739 // Otherwise, a load could come from anywhere, so bail. 740 return false; 741 } 742 if (auto *SI = dyn_cast<SelectInst>(Input)) { 743 const Value *LHS = GetUnderlyingObject(SI->getTrueValue(), DL); 744 const Value *RHS = GetUnderlyingObject(SI->getFalseValue(), DL); 745 if (Visited.insert(LHS).second) 746 Inputs.push_back(LHS); 747 if (Visited.insert(RHS).second) 748 Inputs.push_back(RHS); 749 continue; 750 } 751 if (auto *PN = dyn_cast<PHINode>(Input)) { 752 for (const Value *Op : PN->incoming_values()) { 753 Op = GetUnderlyingObject(Op, DL); 754 if (Visited.insert(Op).second) 755 Inputs.push_back(Op); 756 } 757 continue; 758 } 759 760 // FIXME: It would be good to handle other obvious no-alias cases here, but 761 // it isn't clear how to do so reasonbly without building a small version 762 // of BasicAA into this code. We could recurse into AAResultBase::alias 763 // here but that seems likely to go poorly as we're inside the 764 // implementation of such a query. Until then, just conservatievly retun 765 // false. 766 return false; 767 } while (!Inputs.empty()); 768 769 // If all the inputs to V were definitively no-alias, then V is no-alias. 770 return true; 771 } 772 773 /// alias - If one of the pointers is to a global that we are tracking, and the 774 /// other is some random pointer, we know there cannot be an alias, because the 775 /// address of the global isn't taken. 776 AliasResult GlobalsAAResult::alias(const MemoryLocation &LocA, 777 const MemoryLocation &LocB) { 778 // Get the base object these pointers point to. 779 const Value *UV1 = GetUnderlyingObject(LocA.Ptr, DL); 780 const Value *UV2 = GetUnderlyingObject(LocB.Ptr, DL); 781 782 // If either of the underlying values is a global, they may be non-addr-taken 783 // globals, which we can answer queries about. 784 const GlobalValue *GV1 = dyn_cast<GlobalValue>(UV1); 785 const GlobalValue *GV2 = dyn_cast<GlobalValue>(UV2); 786 if (GV1 || GV2) { 787 // If the global's address is taken, pretend we don't know it's a pointer to 788 // the global. 789 if (GV1 && !NonAddressTakenGlobals.count(GV1)) 790 GV1 = nullptr; 791 if (GV2 && !NonAddressTakenGlobals.count(GV2)) 792 GV2 = nullptr; 793 794 // If the two pointers are derived from two different non-addr-taken 795 // globals we know these can't alias. 796 if (GV1 && GV2 && GV1 != GV2) 797 return NoAlias; 798 799 // If one is and the other isn't, it isn't strictly safe but we can fake 800 // this result if necessary for performance. This does not appear to be 801 // a common problem in practice. 802 if (EnableUnsafeGlobalsModRefAliasResults) 803 if ((GV1 || GV2) && GV1 != GV2) 804 return NoAlias; 805 806 // Check for a special case where a non-escaping global can be used to 807 // conclude no-alias. 808 if ((GV1 || GV2) && GV1 != GV2) { 809 const GlobalValue *GV = GV1 ? GV1 : GV2; 810 const Value *UV = GV1 ? UV2 : UV1; 811 if (isNonEscapingGlobalNoAlias(GV, UV)) 812 return NoAlias; 813 } 814 815 // Otherwise if they are both derived from the same addr-taken global, we 816 // can't know the two accesses don't overlap. 817 } 818 819 // These pointers may be based on the memory owned by an indirect global. If 820 // so, we may be able to handle this. First check to see if the base pointer 821 // is a direct load from an indirect global. 822 GV1 = GV2 = nullptr; 823 if (const LoadInst *LI = dyn_cast<LoadInst>(UV1)) 824 if (GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0))) 825 if (IndirectGlobals.count(GV)) 826 GV1 = GV; 827 if (const LoadInst *LI = dyn_cast<LoadInst>(UV2)) 828 if (const GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0))) 829 if (IndirectGlobals.count(GV)) 830 GV2 = GV; 831 832 // These pointers may also be from an allocation for the indirect global. If 833 // so, also handle them. 834 if (!GV1) 835 GV1 = AllocsForIndirectGlobals.lookup(UV1); 836 if (!GV2) 837 GV2 = AllocsForIndirectGlobals.lookup(UV2); 838 839 // Now that we know whether the two pointers are related to indirect globals, 840 // use this to disambiguate the pointers. If the pointers are based on 841 // different indirect globals they cannot alias. 842 if (GV1 && GV2 && GV1 != GV2) 843 return NoAlias; 844 845 // If one is based on an indirect global and the other isn't, it isn't 846 // strictly safe but we can fake this result if necessary for performance. 847 // This does not appear to be a common problem in practice. 848 if (EnableUnsafeGlobalsModRefAliasResults) 849 if ((GV1 || GV2) && GV1 != GV2) 850 return NoAlias; 851 852 return AAResultBase::alias(LocA, LocB); 853 } 854 855 ModRefInfo GlobalsAAResult::getModRefInfoForArgument(ImmutableCallSite CS, 856 const GlobalValue *GV) { 857 if (CS.doesNotAccessMemory()) 858 return MRI_NoModRef; 859 ModRefInfo ConservativeResult = CS.onlyReadsMemory() ? MRI_Ref : MRI_ModRef; 860 861 // Iterate through all the arguments to the called function. If any argument 862 // is based on GV, return the conservative result. 863 for (auto &A : CS.args()) { 864 SmallVector<Value*, 4> Objects; 865 GetUnderlyingObjects(A, Objects, DL); 866 867 // All objects must be identified. 868 if (!std::all_of(Objects.begin(), Objects.end(), isIdentifiedObject) && 869 // Try ::alias to see if all objects are known not to alias GV. 870 !std::all_of(Objects.begin(), Objects.end(), [&](Value *V) { 871 return this->alias(MemoryLocation(V), MemoryLocation(GV)) == NoAlias; 872 })) 873 return ConservativeResult; 874 875 if (std::find(Objects.begin(), Objects.end(), GV) != Objects.end()) 876 return ConservativeResult; 877 } 878 879 // We identified all objects in the argument list, and none of them were GV. 880 return MRI_NoModRef; 881 } 882 883 ModRefInfo GlobalsAAResult::getModRefInfo(ImmutableCallSite CS, 884 const MemoryLocation &Loc) { 885 unsigned Known = MRI_ModRef; 886 887 // If we are asking for mod/ref info of a direct call with a pointer to a 888 // global we are tracking, return information if we have it. 889 if (const GlobalValue *GV = 890 dyn_cast<GlobalValue>(GetUnderlyingObject(Loc.Ptr, DL))) 891 if (GV->hasLocalLinkage()) 892 if (const Function *F = CS.getCalledFunction()) 893 if (NonAddressTakenGlobals.count(GV)) 894 if (const FunctionInfo *FI = getFunctionInfo(F)) 895 Known = FI->getModRefInfoForGlobal(*GV) | 896 getModRefInfoForArgument(CS, GV); 897 898 if (Known == MRI_NoModRef) 899 return MRI_NoModRef; // No need to query other mod/ref analyses 900 return ModRefInfo(Known & AAResultBase::getModRefInfo(CS, Loc)); 901 } 902 903 GlobalsAAResult::GlobalsAAResult(const DataLayout &DL, 904 const TargetLibraryInfo &TLI) 905 : AAResultBase(), DL(DL), TLI(TLI) {} 906 907 GlobalsAAResult::GlobalsAAResult(GlobalsAAResult &&Arg) 908 : AAResultBase(std::move(Arg)), DL(Arg.DL), TLI(Arg.TLI), 909 NonAddressTakenGlobals(std::move(Arg.NonAddressTakenGlobals)), 910 IndirectGlobals(std::move(Arg.IndirectGlobals)), 911 AllocsForIndirectGlobals(std::move(Arg.AllocsForIndirectGlobals)), 912 FunctionInfos(std::move(Arg.FunctionInfos)), 913 Handles(std::move(Arg.Handles)) { 914 // Update the parent for each DeletionCallbackHandle. 915 for (auto &H : Handles) { 916 assert(H.GAR == &Arg); 917 H.GAR = this; 918 } 919 } 920 921 GlobalsAAResult::~GlobalsAAResult() {} 922 923 /*static*/ GlobalsAAResult 924 GlobalsAAResult::analyzeModule(Module &M, const TargetLibraryInfo &TLI, 925 CallGraph &CG) { 926 GlobalsAAResult Result(M.getDataLayout(), TLI); 927 928 // Discover which functions aren't recursive, to feed into AnalyzeGlobals. 929 Result.CollectSCCMembership(CG); 930 931 // Find non-addr taken globals. 932 Result.AnalyzeGlobals(M); 933 934 // Propagate on CG. 935 Result.AnalyzeCallGraph(CG, M); 936 937 return Result; 938 } 939 940 char GlobalsAA::PassID; 941 942 GlobalsAAResult GlobalsAA::run(Module &M, AnalysisManager<Module> &AM) { 943 return GlobalsAAResult::analyzeModule(M, 944 AM.getResult<TargetLibraryAnalysis>(M), 945 AM.getResult<CallGraphAnalysis>(M)); 946 } 947 948 char GlobalsAAWrapperPass::ID = 0; 949 INITIALIZE_PASS_BEGIN(GlobalsAAWrapperPass, "globals-aa", 950 "Globals Alias Analysis", false, true) 951 INITIALIZE_PASS_DEPENDENCY(CallGraphWrapperPass) 952 INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass) 953 INITIALIZE_PASS_END(GlobalsAAWrapperPass, "globals-aa", 954 "Globals Alias Analysis", false, true) 955 956 ModulePass *llvm::createGlobalsAAWrapperPass() { 957 return new GlobalsAAWrapperPass(); 958 } 959 960 GlobalsAAWrapperPass::GlobalsAAWrapperPass() : ModulePass(ID) { 961 initializeGlobalsAAWrapperPassPass(*PassRegistry::getPassRegistry()); 962 } 963 964 bool GlobalsAAWrapperPass::runOnModule(Module &M) { 965 Result.reset(new GlobalsAAResult(GlobalsAAResult::analyzeModule( 966 M, getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(), 967 getAnalysis<CallGraphWrapperPass>().getCallGraph()))); 968 return false; 969 } 970 971 bool GlobalsAAWrapperPass::doFinalization(Module &M) { 972 Result.reset(); 973 return false; 974 } 975 976 void GlobalsAAWrapperPass::getAnalysisUsage(AnalysisUsage &AU) const { 977 AU.setPreservesAll(); 978 AU.addRequired<CallGraphWrapperPass>(); 979 AU.addRequired<TargetLibraryInfoWrapperPass>(); 980 } 981