1//===- GlobalsModRef.cpp - Simple Mod/Ref Analysis for Globals ------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This simple pass provides alias and mod/ref information for global values
10// that do not have their address taken, and keeps track of whether functions
11// read or write memory (are "pure"). For this simple (but very common) case,
12// we can provide pretty accurate and useful information.
13//
14//===----------------------------------------------------------------------===//
15
16#include "llvm/Analysis/GlobalsModRef.h"
17#include "llvm/ADT/SCCIterator.h"
18#include "llvm/ADT/SmallPtrSet.h"
19#include "llvm/ADT/Statistic.h"
20#include "llvm/Analysis/CallGraph.h"
21#include "llvm/Analysis/MemoryBuiltins.h"
22#include "llvm/Analysis/TargetLibraryInfo.h"
23#include "llvm/Analysis/ValueTracking.h"
24#include "llvm/IR/InstIterator.h"
25#include "llvm/IR/Instructions.h"
26#include "llvm/IR/Module.h"
27#include "llvm/IR/PassManager.h"
28#include "llvm/InitializePasses.h"
29#include "llvm/Pass.h"
30#include "llvm/Support/CommandLine.h"
31
32using namespace llvm;
33
34#define DEBUG_TYPE "globalsmodref-aa"
35
36STATISTIC(NumNonAddrTakenGlobalVars,
37 "Number of global vars without address taken");
38STATISTIC(NumNonAddrTakenFunctions,"Number of functions without address taken");
39STATISTIC(NumNoMemFunctions, "Number of functions that do not access memory");
40STATISTIC(NumReadMemFunctions, "Number of functions that only read memory");
41STATISTIC(NumIndirectGlobalVars, "Number of indirect global objects");
42
43// An option to enable unsafe alias results from the GlobalsModRef analysis.
44// When enabled, GlobalsModRef will provide no-alias results which in extremely
45// rare cases may not be conservatively correct. In particular, in the face of
46// transforms which cause asymmetry between how effective getUnderlyingObject
47// is for two pointers, it may produce incorrect results.
48//
49// These unsafe results have been returned by GMR for many years without
50// causing significant issues in the wild and so we provide a mechanism to
51// re-enable them for users of LLVM that have a particular performance
52// sensitivity and no known issues. The option also makes it easy to evaluate
53// the performance impact of these results.
54static cl::opt<bool> EnableUnsafeGlobalsModRefAliasResults(
55 "enable-unsafe-globalsmodref-alias-results", cl::init(Val: false), cl::Hidden);
56
57/// The mod/ref information collected for a particular function.
58///
59/// We collect information about mod/ref behavior of a function here, both in
60/// general and as pertains to specific globals. We only have this detailed
61/// information when we know *something* useful about the behavior. If we
62/// saturate to fully general mod/ref, we remove the info for the function.
63class GlobalsAAResult::FunctionInfo {
64 typedef SmallDenseMap<const GlobalValue *, ModRefInfo, 16> GlobalInfoMapType;
65
66 /// Build a wrapper struct that has 8-byte alignment. All heap allocations
67 /// should provide this much alignment at least, but this makes it clear we
68 /// specifically rely on this amount of alignment.
69 struct alignas(8) AlignedMap {
70 AlignedMap() = default;
71 AlignedMap(const AlignedMap &Arg) = default;
72 GlobalInfoMapType Map;
73 };
74
75 /// Pointer traits for our aligned map.
76 struct AlignedMapPointerTraits {
77 static inline void *getAsVoidPointer(AlignedMap *P) { return P; }
78 static inline AlignedMap *getFromVoidPointer(void *P) {
79 return (AlignedMap *)P;
80 }
81 static constexpr int NumLowBitsAvailable = 3;
82 static_assert(alignof(AlignedMap) >= (1 << NumLowBitsAvailable),
83 "AlignedMap insufficiently aligned to have enough low bits.");
84 };
85
86 /// The bit that flags that this function may read any global. This is
87 /// chosen to mix together with ModRefInfo bits.
88 /// FIXME: This assumes ModRefInfo lattice will remain 4 bits!
89 /// FunctionInfo.getModRefInfo() masks out everything except ModRef so
90 /// this remains correct.
91 enum { MayReadAnyGlobal = 4 };
92
93 /// Checks to document the invariants of the bit packing here.
94 static_assert((MayReadAnyGlobal & static_cast<int>(ModRefInfo::ModRef)) == 0,
95 "ModRef and the MayReadAnyGlobal flag bits overlap.");
96 static_assert(((MayReadAnyGlobal | static_cast<int>(ModRefInfo::ModRef)) >>
97 AlignedMapPointerTraits::NumLowBitsAvailable) == 0,
98 "Insufficient low bits to store our flag and ModRef info.");
99
100public:
101 FunctionInfo() = default;
102 ~FunctionInfo() {
103 delete Info.getPointer();
104 }
105 // Spell out the copy ond move constructors and assignment operators to get
106 // deep copy semantics and correct move semantics in the face of the
107 // pointer-int pair.
108 FunctionInfo(const FunctionInfo &Arg)
109 : Info(nullptr, Arg.Info.getInt()) {
110 if (const auto *ArgPtr = Arg.Info.getPointer())
111 Info.setPointer(new AlignedMap(*ArgPtr));
112 }
113 FunctionInfo(FunctionInfo &&Arg)
114 : Info(Arg.Info.getPointer(), Arg.Info.getInt()) {
115 Arg.Info.setPointerAndInt(PtrVal: nullptr, IntVal: 0);
116 }
117 FunctionInfo &operator=(const FunctionInfo &RHS) {
118 delete Info.getPointer();
119 Info.setPointerAndInt(PtrVal: nullptr, IntVal: RHS.Info.getInt());
120 if (const auto *RHSPtr = RHS.Info.getPointer())
121 Info.setPointer(new AlignedMap(*RHSPtr));
122 return *this;
123 }
124 FunctionInfo &operator=(FunctionInfo &&RHS) {
125 delete Info.getPointer();
126 Info.setPointerAndInt(PtrVal: RHS.Info.getPointer(), IntVal: RHS.Info.getInt());
127 RHS.Info.setPointerAndInt(PtrVal: nullptr, IntVal: 0);
128 return *this;
129 }
130
131 /// This method clears MayReadAnyGlobal bit added by GlobalsAAResult to return
132 /// the corresponding ModRefInfo.
133 ModRefInfo globalClearMayReadAnyGlobal(int I) const {
134 return ModRefInfo(I & static_cast<int>(ModRefInfo::ModRef));
135 }
136
137 /// Returns the \c ModRefInfo info for this function.
138 ModRefInfo getModRefInfo() const {
139 return globalClearMayReadAnyGlobal(I: Info.getInt());
140 }
141
142 /// Adds new \c ModRefInfo for this function to its state.
143 void addModRefInfo(ModRefInfo NewMRI) {
144 Info.setInt(Info.getInt() | static_cast<int>(NewMRI));
145 }
146
147 /// Returns whether this function may read any global variable, and we don't
148 /// know which global.
149 bool mayReadAnyGlobal() const { return Info.getInt() & MayReadAnyGlobal; }
150
151 /// Sets this function as potentially reading from any global.
152 void setMayReadAnyGlobal() { Info.setInt(Info.getInt() | MayReadAnyGlobal); }
153
154 /// Returns the \c ModRefInfo info for this function w.r.t. a particular
155 /// global, which may be more precise than the general information above.
156 ModRefInfo getModRefInfoForGlobal(const GlobalValue &GV) const {
157 ModRefInfo GlobalMRI =
158 mayReadAnyGlobal() ? ModRefInfo::Ref : ModRefInfo::NoModRef;
159 if (AlignedMap *P = Info.getPointer()) {
160 auto I = P->Map.find(Val: &GV);
161 if (I != P->Map.end())
162 GlobalMRI |= I->second;
163 }
164 return GlobalMRI;
165 }
166
167 /// Add mod/ref info from another function into ours, saturating towards
168 /// ModRef.
169 void addFunctionInfo(const FunctionInfo &FI) {
170 addModRefInfo(NewMRI: FI.getModRefInfo());
171
172 if (FI.mayReadAnyGlobal())
173 setMayReadAnyGlobal();
174
175 if (AlignedMap *P = FI.Info.getPointer())
176 for (const auto &G : P->Map)
177 addModRefInfoForGlobal(GV: *G.first, NewMRI: G.second);
178 }
179
180 void addModRefInfoForGlobal(const GlobalValue &GV, ModRefInfo NewMRI) {
181 AlignedMap *P = Info.getPointer();
182 if (!P) {
183 P = new AlignedMap();
184 Info.setPointer(P);
185 }
186 auto &GlobalMRI = P->Map[&GV];
187 GlobalMRI |= NewMRI;
188 }
189
190 /// Clear a global's ModRef info. Should be used when a global is being
191 /// deleted.
192 void eraseModRefInfoForGlobal(const GlobalValue &GV) {
193 if (AlignedMap *P = Info.getPointer())
194 P->Map.erase(Val: &GV);
195 }
196
197private:
198 /// All of the information is encoded into a single pointer, with a three bit
199 /// integer in the low three bits. The high bit provides a flag for when this
200 /// function may read any global. The low two bits are the ModRefInfo. And
201 /// the pointer, when non-null, points to a map from GlobalValue to
202 /// ModRefInfo specific to that GlobalValue.
203 PointerIntPair<AlignedMap *, 3, unsigned, AlignedMapPointerTraits> Info;
204};
205
206void GlobalsAAResult::DeletionCallbackHandle::deleted() {
207 Value *V = getValPtr();
208 if (auto *F = dyn_cast<Function>(Val: V))
209 GAR->FunctionInfos.erase(Val: F);
210
211 if (GlobalValue *GV = dyn_cast<GlobalValue>(Val: V)) {
212 if (GAR->NonAddressTakenGlobals.erase(Ptr: GV)) {
213 // This global might be an indirect global. If so, remove it and
214 // remove any AllocRelatedValues for it.
215 if (GAR->IndirectGlobals.erase(Ptr: GV)) {
216 // Remove any entries in AllocsForIndirectGlobals for this global.
217 for (auto I = GAR->AllocsForIndirectGlobals.begin(),
218 E = GAR->AllocsForIndirectGlobals.end();
219 I != E; ++I)
220 if (I->second == GV)
221 GAR->AllocsForIndirectGlobals.erase(I);
222 }
223
224 // Scan the function info we have collected and remove this global
225 // from all of them.
226 for (auto &FIPair : GAR->FunctionInfos)
227 FIPair.second.eraseModRefInfoForGlobal(GV: *GV);
228 }
229 }
230
231 // If this is an allocation related to an indirect global, remove it.
232 GAR->AllocsForIndirectGlobals.erase(Val: V);
233
234 // And clear out the handle.
235 setValPtr(nullptr);
236 GAR->Handles.erase(position: I);
237 // This object is now destroyed!
238}
239
240MemoryEffects GlobalsAAResult::getMemoryEffects(const Function *F) {
241 if (FunctionInfo *FI = getFunctionInfo(F))
242 return MemoryEffects(FI->getModRefInfo());
243
244 return MemoryEffects::unknown();
245}
246
247/// Returns the function info for the function, or null if we don't have
248/// anything useful to say about it.
249GlobalsAAResult::FunctionInfo *
250GlobalsAAResult::getFunctionInfo(const Function *F) {
251 auto I = FunctionInfos.find(Val: F);
252 if (I != FunctionInfos.end())
253 return &I->second;
254 return nullptr;
255}
256
257/// AnalyzeGlobals - Scan through the users of all of the internal
258/// GlobalValue's in the program. If none of them have their "address taken"
259/// (really, their address passed to something nontrivial), record this fact,
260/// and record the functions that they are used directly in.
261void GlobalsAAResult::AnalyzeGlobals(Module &M) {
262 SmallPtrSet<Function *, 32> TrackedFunctions;
263 for (Function &F : M)
264 if (F.hasLocalLinkage()) {
265 if (!AnalyzeUsesOfPointer(V: &F)) {
266 // Remember that we are tracking this global.
267 NonAddressTakenGlobals.insert(Ptr: &F);
268 TrackedFunctions.insert(Ptr: &F);
269 Handles.emplace_front(args&: *this, args: &F);
270 Handles.front().I = Handles.begin();
271 ++NumNonAddrTakenFunctions;
272 } else
273 UnknownFunctionsWithLocalLinkage = true;
274 }
275
276 SmallPtrSet<Function *, 16> Readers, Writers;
277 for (GlobalVariable &GV : M.globals())
278 if (GV.hasLocalLinkage()) {
279 if (!AnalyzeUsesOfPointer(V: &GV, Readers: &Readers,
280 Writers: GV.isConstant() ? nullptr : &Writers)) {
281 // Remember that we are tracking this global, and the mod/ref fns
282 NonAddressTakenGlobals.insert(Ptr: &GV);
283 Handles.emplace_front(args&: *this, args: &GV);
284 Handles.front().I = Handles.begin();
285
286 for (Function *Reader : Readers) {
287 if (TrackedFunctions.insert(Ptr: Reader).second) {
288 Handles.emplace_front(args&: *this, args&: Reader);
289 Handles.front().I = Handles.begin();
290 }
291 FunctionInfos[Reader].addModRefInfoForGlobal(GV, NewMRI: ModRefInfo::Ref);
292 }
293
294 if (!GV.isConstant()) // No need to keep track of writers to constants
295 for (Function *Writer : Writers) {
296 if (TrackedFunctions.insert(Ptr: Writer).second) {
297 Handles.emplace_front(args&: *this, args&: Writer);
298 Handles.front().I = Handles.begin();
299 }
300 FunctionInfos[Writer].addModRefInfoForGlobal(GV, NewMRI: ModRefInfo::Mod);
301 }
302 ++NumNonAddrTakenGlobalVars;
303
304 // If this global holds a pointer type, see if it is an indirect global.
305 if (GV.getValueType()->isPointerTy() &&
306 AnalyzeIndirectGlobalMemory(GV: &GV))
307 ++NumIndirectGlobalVars;
308 }
309 Readers.clear();
310 Writers.clear();
311 }
312}
313
314/// AnalyzeUsesOfPointer - Look at all of the users of the specified pointer.
315/// If this is used by anything complex (i.e., the address escapes), return
316/// true. Also, while we are at it, keep track of those functions that read and
317/// write to the value.
318///
319/// If OkayStoreDest is non-null, stores into this global are allowed.
320bool GlobalsAAResult::AnalyzeUsesOfPointer(Value *V,
321 SmallPtrSetImpl<Function *> *Readers,
322 SmallPtrSetImpl<Function *> *Writers,
323 GlobalValue *OkayStoreDest) {
324 if (!V->getType()->isPointerTy())
325 return true;
326
327 for (Use &U : V->uses()) {
328 User *I = U.getUser();
329 if (LoadInst *LI = dyn_cast<LoadInst>(Val: I)) {
330 if (Readers)
331 Readers->insert(Ptr: LI->getParent()->getParent());
332 } else if (StoreInst *SI = dyn_cast<StoreInst>(Val: I)) {
333 if (V == SI->getOperand(i_nocapture: 1)) {
334 if (Writers)
335 Writers->insert(Ptr: SI->getParent()->getParent());
336 } else if (SI->getOperand(i_nocapture: 1) != OkayStoreDest) {
337 return true; // Storing the pointer
338 }
339 } else if (Operator::getOpcode(V: I) == Instruction::GetElementPtr) {
340 if (AnalyzeUsesOfPointer(V: I, Readers, Writers))
341 return true;
342 } else if (Operator::getOpcode(V: I) == Instruction::BitCast ||
343 Operator::getOpcode(V: I) == Instruction::AddrSpaceCast) {
344 if (AnalyzeUsesOfPointer(V: I, Readers, Writers, OkayStoreDest))
345 return true;
346 } else if (auto *Call = dyn_cast<CallBase>(Val: I)) {
347 // Make sure that this is just the function being called, not that it is
348 // passing into the function.
349 if (Call->isDataOperand(U: &U)) {
350 // Detect calls to free.
351 if (Call->isArgOperand(U: &U) &&
352 getFreedOperand(CB: Call, TLI: &GetTLI(*Call->getFunction())) == U) {
353 if (Writers)
354 Writers->insert(Ptr: Call->getParent()->getParent());
355 } else {
356 // In general, we return true for unknown calls, but there are
357 // some simple checks that we can do for functions that
358 // will never call back into the module.
359 auto *F = Call->getCalledFunction();
360 // TODO: we should be able to remove isDeclaration() check
361 // and let the function body analysis check for captures,
362 // and collect the mod-ref effects. This information will
363 // be later propagated via the call graph.
364 if (!F || !F->isDeclaration())
365 return true;
366 // Note that the NoCallback check here is a little bit too
367 // conservative. If there are no captures of the global
368 // in the module, then this call may not be a capture even
369 // if it does not have NoCallback.
370 if (!Call->hasFnAttr(Attribute::NoCallback) ||
371 !Call->isArgOperand(U: &U) ||
372 !Call->doesNotCapture(OpNo: Call->getArgOperandNo(U: &U)))
373 return true;
374
375 // Conservatively, assume the call reads and writes the global.
376 // We could use memory attributes to make it more precise.
377 if (Readers)
378 Readers->insert(Ptr: Call->getParent()->getParent());
379 if (Writers)
380 Writers->insert(Ptr: Call->getParent()->getParent());
381 }
382 }
383 } else if (ICmpInst *ICI = dyn_cast<ICmpInst>(Val: I)) {
384 if (!isa<ConstantPointerNull>(Val: ICI->getOperand(i_nocapture: 1)))
385 return true; // Allow comparison against null.
386 } else if (Constant *C = dyn_cast<Constant>(Val: I)) {
387 // Ignore constants which don't have any live uses.
388 if (isa<GlobalValue>(Val: C) || C->isConstantUsed())
389 return true;
390 } else {
391 return true;
392 }
393 }
394
395 return false;
396}
397
398/// AnalyzeIndirectGlobalMemory - We found an non-address-taken global variable
399/// which holds a pointer type. See if the global always points to non-aliased
400/// heap memory: that is, all initializers of the globals store a value known
401/// to be obtained via a noalias return function call which have no other use.
402/// Further, all loads out of GV must directly use the memory, not store the
403/// pointer somewhere. If this is true, we consider the memory pointed to by
404/// GV to be owned by GV and can disambiguate other pointers from it.
405bool GlobalsAAResult::AnalyzeIndirectGlobalMemory(GlobalVariable *GV) {
406 // Keep track of values related to the allocation of the memory, f.e. the
407 // value produced by the noalias call and any casts.
408 std::vector<Value *> AllocRelatedValues;
409
410 // If the initializer is a valid pointer, bail.
411 if (Constant *C = GV->getInitializer())
412 if (!C->isNullValue())
413 return false;
414
415 // Walk the user list of the global. If we find anything other than a direct
416 // load or store, bail out.
417 for (User *U : GV->users()) {
418 if (LoadInst *LI = dyn_cast<LoadInst>(Val: U)) {
419 // The pointer loaded from the global can only be used in simple ways:
420 // we allow addressing of it and loading storing to it. We do *not* allow
421 // storing the loaded pointer somewhere else or passing to a function.
422 if (AnalyzeUsesOfPointer(V: LI))
423 return false; // Loaded pointer escapes.
424 // TODO: Could try some IP mod/ref of the loaded pointer.
425 } else if (StoreInst *SI = dyn_cast<StoreInst>(Val: U)) {
426 // Storing the global itself.
427 if (SI->getOperand(i_nocapture: 0) == GV)
428 return false;
429
430 // If storing the null pointer, ignore it.
431 if (isa<ConstantPointerNull>(Val: SI->getOperand(i_nocapture: 0)))
432 continue;
433
434 // Check the value being stored.
435 Value *Ptr = getUnderlyingObject(V: SI->getOperand(i_nocapture: 0));
436
437 if (!isNoAliasCall(V: Ptr))
438 return false; // Too hard to analyze.
439
440 // Analyze all uses of the allocation. If any of them are used in a
441 // non-simple way (e.g. stored to another global) bail out.
442 if (AnalyzeUsesOfPointer(V: Ptr, /*Readers*/ nullptr, /*Writers*/ nullptr,
443 OkayStoreDest: GV))
444 return false; // Loaded pointer escapes.
445
446 // Remember that this allocation is related to the indirect global.
447 AllocRelatedValues.push_back(x: Ptr);
448 } else {
449 // Something complex, bail out.
450 return false;
451 }
452 }
453
454 // Okay, this is an indirect global. Remember all of the allocations for
455 // this global in AllocsForIndirectGlobals.
456 while (!AllocRelatedValues.empty()) {
457 AllocsForIndirectGlobals[AllocRelatedValues.back()] = GV;
458 Handles.emplace_front(args&: *this, args&: AllocRelatedValues.back());
459 Handles.front().I = Handles.begin();
460 AllocRelatedValues.pop_back();
461 }
462 IndirectGlobals.insert(Ptr: GV);
463 Handles.emplace_front(args&: *this, args&: GV);
464 Handles.front().I = Handles.begin();
465 return true;
466}
467
468void GlobalsAAResult::CollectSCCMembership(CallGraph &CG) {
469 // We do a bottom-up SCC traversal of the call graph. In other words, we
470 // visit all callees before callers (leaf-first).
471 unsigned SCCID = 0;
472 for (scc_iterator<CallGraph *> I = scc_begin(G: &CG); !I.isAtEnd(); ++I) {
473 const std::vector<CallGraphNode *> &SCC = *I;
474 assert(!SCC.empty() && "SCC with no functions?");
475
476 for (auto *CGN : SCC)
477 if (Function *F = CGN->getFunction())
478 FunctionToSCCMap[F] = SCCID;
479 ++SCCID;
480 }
481}
482
483/// AnalyzeCallGraph - At this point, we know the functions where globals are
484/// immediately stored to and read from. Propagate this information up the call
485/// graph to all callers and compute the mod/ref info for all memory for each
486/// function.
487void GlobalsAAResult::AnalyzeCallGraph(CallGraph &CG, Module &M) {
488 // We do a bottom-up SCC traversal of the call graph. In other words, we
489 // visit all callees before callers (leaf-first).
490 for (scc_iterator<CallGraph *> I = scc_begin(G: &CG); !I.isAtEnd(); ++I) {
491 const std::vector<CallGraphNode *> &SCC = *I;
492 assert(!SCC.empty() && "SCC with no functions?");
493
494 Function *F = SCC[0]->getFunction();
495
496 if (!F || !F->isDefinitionExact()) {
497 // Calls externally or not exact - can't say anything useful. Remove any
498 // existing function records (may have been created when scanning
499 // globals).
500 for (auto *Node : SCC)
501 FunctionInfos.erase(Val: Node->getFunction());
502 continue;
503 }
504
505 FunctionInfo &FI = FunctionInfos[F];
506 Handles.emplace_front(args&: *this, args&: F);
507 Handles.front().I = Handles.begin();
508 bool KnowNothing = false;
509
510 // Intrinsics, like any other synchronizing function, can make effects
511 // of other threads visible. Without nosync we know nothing really.
512 // Similarly, if `nocallback` is missing the function, or intrinsic,
513 // can call into the module arbitrarily. If both are set the function
514 // has an effect but will not interact with accesses of internal
515 // globals inside the module. We are conservative here for optnone
516 // functions, might not be necessary.
517 auto MaySyncOrCallIntoModule = [](const Function &F) {
518 return !F.isDeclaration() || !F.hasNoSync() ||
519 !F.hasFnAttribute(Attribute::NoCallback);
520 };
521
522 // Collect the mod/ref properties due to called functions. We only compute
523 // one mod-ref set.
524 for (unsigned i = 0, e = SCC.size(); i != e && !KnowNothing; ++i) {
525 if (!F) {
526 KnowNothing = true;
527 break;
528 }
529
530 if (F->isDeclaration() || F->hasOptNone()) {
531 // Try to get mod/ref behaviour from function attributes.
532 if (F->doesNotAccessMemory()) {
533 // Can't do better than that!
534 } else if (F->onlyReadsMemory()) {
535 FI.addModRefInfo(NewMRI: ModRefInfo::Ref);
536 if (!F->onlyAccessesArgMemory() && MaySyncOrCallIntoModule(*F))
537 // This function might call back into the module and read a global -
538 // consider every global as possibly being read by this function.
539 FI.setMayReadAnyGlobal();
540 } else {
541 FI.addModRefInfo(NewMRI: ModRefInfo::ModRef);
542 if (!F->onlyAccessesArgMemory())
543 FI.setMayReadAnyGlobal();
544 if (MaySyncOrCallIntoModule(*F)) {
545 KnowNothing = true;
546 break;
547 }
548 }
549 continue;
550 }
551
552 for (CallGraphNode::iterator CI = SCC[i]->begin(), E = SCC[i]->end();
553 CI != E && !KnowNothing; ++CI)
554 if (Function *Callee = CI->second->getFunction()) {
555 if (FunctionInfo *CalleeFI = getFunctionInfo(F: Callee)) {
556 // Propagate function effect up.
557 FI.addFunctionInfo(FI: *CalleeFI);
558 } else {
559 // Can't say anything about it. However, if it is inside our SCC,
560 // then nothing needs to be done.
561 CallGraphNode *CalleeNode = CG[Callee];
562 if (!is_contained(Range: SCC, Element: CalleeNode))
563 KnowNothing = true;
564 }
565 } else {
566 KnowNothing = true;
567 }
568 }
569
570 // If we can't say anything useful about this SCC, remove all SCC functions
571 // from the FunctionInfos map.
572 if (KnowNothing) {
573 for (auto *Node : SCC)
574 FunctionInfos.erase(Val: Node->getFunction());
575 continue;
576 }
577
578 // Scan the function bodies for explicit loads or stores.
579 for (auto *Node : SCC) {
580 if (isModAndRefSet(MRI: FI.getModRefInfo()))
581 break; // The mod/ref lattice saturates here.
582
583 // Don't prove any properties based on the implementation of an optnone
584 // function. Function attributes were already used as a best approximation
585 // above.
586 if (Node->getFunction()->hasOptNone())
587 continue;
588
589 for (Instruction &I : instructions(F: Node->getFunction())) {
590 if (isModAndRefSet(MRI: FI.getModRefInfo()))
591 break; // The mod/ref lattice saturates here.
592
593 // We handle calls specially because the graph-relevant aspects are
594 // handled above.
595 if (isa<CallBase>(Val: &I))
596 continue;
597
598 // All non-call instructions we use the primary predicates for whether
599 // they read or write memory.
600 if (I.mayReadFromMemory())
601 FI.addModRefInfo(NewMRI: ModRefInfo::Ref);
602 if (I.mayWriteToMemory())
603 FI.addModRefInfo(NewMRI: ModRefInfo::Mod);
604 }
605 }
606
607 if (!isModSet(MRI: FI.getModRefInfo()))
608 ++NumReadMemFunctions;
609 if (!isModOrRefSet(MRI: FI.getModRefInfo()))
610 ++NumNoMemFunctions;
611
612 // Finally, now that we know the full effect on this SCC, clone the
613 // information to each function in the SCC.
614 // FI is a reference into FunctionInfos, so copy it now so that it doesn't
615 // get invalidated if DenseMap decides to re-hash.
616 FunctionInfo CachedFI = FI;
617 for (unsigned i = 1, e = SCC.size(); i != e; ++i)
618 FunctionInfos[SCC[i]->getFunction()] = CachedFI;
619 }
620}
621
622// GV is a non-escaping global. V is a pointer address that has been loaded from.
623// If we can prove that V must escape, we can conclude that a load from V cannot
624// alias GV.
625static bool isNonEscapingGlobalNoAliasWithLoad(const GlobalValue *GV,
626 const Value *V,
627 int &Depth,
628 const DataLayout &DL) {
629 SmallPtrSet<const Value *, 8> Visited;
630 SmallVector<const Value *, 8> Inputs;
631 Visited.insert(Ptr: V);
632 Inputs.push_back(Elt: V);
633 do {
634 const Value *Input = Inputs.pop_back_val();
635
636 if (isa<GlobalValue>(Val: Input) || isa<Argument>(Val: Input) || isa<CallInst>(Val: Input) ||
637 isa<InvokeInst>(Val: Input))
638 // Arguments to functions or returns from functions are inherently
639 // escaping, so we can immediately classify those as not aliasing any
640 // non-addr-taken globals.
641 //
642 // (Transitive) loads from a global are also safe - if this aliased
643 // another global, its address would escape, so no alias.
644 continue;
645
646 // Recurse through a limited number of selects, loads and PHIs. This is an
647 // arbitrary depth of 4, lower numbers could be used to fix compile time
648 // issues if needed, but this is generally expected to be only be important
649 // for small depths.
650 if (++Depth > 4)
651 return false;
652
653 if (auto *LI = dyn_cast<LoadInst>(Val: Input)) {
654 Inputs.push_back(Elt: getUnderlyingObject(V: LI->getPointerOperand()));
655 continue;
656 }
657 if (auto *SI = dyn_cast<SelectInst>(Val: Input)) {
658 const Value *LHS = getUnderlyingObject(V: SI->getTrueValue());
659 const Value *RHS = getUnderlyingObject(V: SI->getFalseValue());
660 if (Visited.insert(Ptr: LHS).second)
661 Inputs.push_back(Elt: LHS);
662 if (Visited.insert(Ptr: RHS).second)
663 Inputs.push_back(Elt: RHS);
664 continue;
665 }
666 if (auto *PN = dyn_cast<PHINode>(Val: Input)) {
667 for (const Value *Op : PN->incoming_values()) {
668 Op = getUnderlyingObject(V: Op);
669 if (Visited.insert(Ptr: Op).second)
670 Inputs.push_back(Elt: Op);
671 }
672 continue;
673 }
674
675 return false;
676 } while (!Inputs.empty());
677
678 // All inputs were known to be no-alias.
679 return true;
680}
681
682// There are particular cases where we can conclude no-alias between
683// a non-addr-taken global and some other underlying object. Specifically,
684// a non-addr-taken global is known to not be escaped from any function. It is
685// also incorrect for a transformation to introduce an escape of a global in
686// a way that is observable when it was not there previously. One function
687// being transformed to introduce an escape which could possibly be observed
688// (via loading from a global or the return value for example) within another
689// function is never safe. If the observation is made through non-atomic
690// operations on different threads, it is a data-race and UB. If the
691// observation is well defined, by being observed the transformation would have
692// changed program behavior by introducing the observed escape, making it an
693// invalid transform.
694//
695// This property does require that transformations which *temporarily* escape
696// a global that was not previously escaped, prior to restoring it, cannot rely
697// on the results of GMR::alias. This seems a reasonable restriction, although
698// currently there is no way to enforce it. There is also no realistic
699// optimization pass that would make this mistake. The closest example is
700// a transformation pass which does reg2mem of SSA values but stores them into
701// global variables temporarily before restoring the global variable's value.
702// This could be useful to expose "benign" races for example. However, it seems
703// reasonable to require that a pass which introduces escapes of global
704// variables in this way to either not trust AA results while the escape is
705// active, or to be forced to operate as a module pass that cannot co-exist
706// with an alias analysis such as GMR.
707bool GlobalsAAResult::isNonEscapingGlobalNoAlias(const GlobalValue *GV,
708 const Value *V) {
709 // In order to know that the underlying object cannot alias the
710 // non-addr-taken global, we must know that it would have to be an escape.
711 // Thus if the underlying object is a function argument, a load from
712 // a global, or the return of a function, it cannot alias. We can also
713 // recurse through PHI nodes and select nodes provided all of their inputs
714 // resolve to one of these known-escaping roots.
715 SmallPtrSet<const Value *, 8> Visited;
716 SmallVector<const Value *, 8> Inputs;
717 Visited.insert(Ptr: V);
718 Inputs.push_back(Elt: V);
719 int Depth = 0;
720 do {
721 const Value *Input = Inputs.pop_back_val();
722
723 if (auto *InputGV = dyn_cast<GlobalValue>(Val: Input)) {
724 // If one input is the very global we're querying against, then we can't
725 // conclude no-alias.
726 if (InputGV == GV)
727 return false;
728
729 // Distinct GlobalVariables never alias, unless overriden or zero-sized.
730 // FIXME: The condition can be refined, but be conservative for now.
731 auto *GVar = dyn_cast<GlobalVariable>(Val: GV);
732 auto *InputGVar = dyn_cast<GlobalVariable>(Val: InputGV);
733 if (GVar && InputGVar &&
734 !GVar->isDeclaration() && !InputGVar->isDeclaration() &&
735 !GVar->isInterposable() && !InputGVar->isInterposable()) {
736 Type *GVType = GVar->getInitializer()->getType();
737 Type *InputGVType = InputGVar->getInitializer()->getType();
738 if (GVType->isSized() && InputGVType->isSized() &&
739 (DL.getTypeAllocSize(Ty: GVType) > 0) &&
740 (DL.getTypeAllocSize(Ty: InputGVType) > 0))
741 continue;
742 }
743
744 // Conservatively return false, even though we could be smarter
745 // (e.g. look through GlobalAliases).
746 return false;
747 }
748
749 if (isa<Argument>(Val: Input) || isa<CallInst>(Val: Input) ||
750 isa<InvokeInst>(Val: Input)) {
751 // Arguments to functions or returns from functions are inherently
752 // escaping, so we can immediately classify those as not aliasing any
753 // non-addr-taken globals.
754 continue;
755 }
756
757 // Recurse through a limited number of selects, loads and PHIs. This is an
758 // arbitrary depth of 4, lower numbers could be used to fix compile time
759 // issues if needed, but this is generally expected to be only be important
760 // for small depths.
761 if (++Depth > 4)
762 return false;
763
764 if (auto *LI = dyn_cast<LoadInst>(Val: Input)) {
765 // A pointer loaded from a global would have been captured, and we know
766 // that the global is non-escaping, so no alias.
767 const Value *Ptr = getUnderlyingObject(V: LI->getPointerOperand());
768 if (isNonEscapingGlobalNoAliasWithLoad(GV, V: Ptr, Depth, DL))
769 // The load does not alias with GV.
770 continue;
771 // Otherwise, a load could come from anywhere, so bail.
772 return false;
773 }
774 if (auto *SI = dyn_cast<SelectInst>(Val: Input)) {
775 const Value *LHS = getUnderlyingObject(V: SI->getTrueValue());
776 const Value *RHS = getUnderlyingObject(V: SI->getFalseValue());
777 if (Visited.insert(Ptr: LHS).second)
778 Inputs.push_back(Elt: LHS);
779 if (Visited.insert(Ptr: RHS).second)
780 Inputs.push_back(Elt: RHS);
781 continue;
782 }
783 if (auto *PN = dyn_cast<PHINode>(Val: Input)) {
784 for (const Value *Op : PN->incoming_values()) {
785 Op = getUnderlyingObject(V: Op);
786 if (Visited.insert(Ptr: Op).second)
787 Inputs.push_back(Elt: Op);
788 }
789 continue;
790 }
791
792 // FIXME: It would be good to handle other obvious no-alias cases here, but
793 // it isn't clear how to do so reasonably without building a small version
794 // of BasicAA into this code.
795 return false;
796 } while (!Inputs.empty());
797
798 // If all the inputs to V were definitively no-alias, then V is no-alias.
799 return true;
800}
801
802bool GlobalsAAResult::invalidate(Module &, const PreservedAnalyses &PA,
803 ModuleAnalysisManager::Invalidator &) {
804 // Check whether the analysis has been explicitly invalidated. Otherwise, it's
805 // stateless and remains preserved.
806 auto PAC = PA.getChecker<GlobalsAA>();
807 return !PAC.preservedWhenStateless();
808}
809
810/// alias - If one of the pointers is to a global that we are tracking, and the
811/// other is some random pointer, we know there cannot be an alias, because the
812/// address of the global isn't taken.
813AliasResult GlobalsAAResult::alias(const MemoryLocation &LocA,
814 const MemoryLocation &LocB,
815 AAQueryInfo &AAQI, const Instruction *) {
816 // Get the base object these pointers point to.
817 const Value *UV1 =
818 getUnderlyingObject(V: LocA.Ptr->stripPointerCastsForAliasAnalysis());
819 const Value *UV2 =
820 getUnderlyingObject(V: LocB.Ptr->stripPointerCastsForAliasAnalysis());
821
822 // If either of the underlying values is a global, they may be non-addr-taken
823 // globals, which we can answer queries about.
824 const GlobalValue *GV1 = dyn_cast<GlobalValue>(Val: UV1);
825 const GlobalValue *GV2 = dyn_cast<GlobalValue>(Val: UV2);
826 if (GV1 || GV2) {
827 // If the global's address is taken, pretend we don't know it's a pointer to
828 // the global.
829 if (GV1 && !NonAddressTakenGlobals.count(Ptr: GV1))
830 GV1 = nullptr;
831 if (GV2 && !NonAddressTakenGlobals.count(Ptr: GV2))
832 GV2 = nullptr;
833
834 // If the two pointers are derived from two different non-addr-taken
835 // globals we know these can't alias.
836 if (GV1 && GV2 && GV1 != GV2)
837 return AliasResult::NoAlias;
838
839 // If one is and the other isn't, it isn't strictly safe but we can fake
840 // this result if necessary for performance. This does not appear to be
841 // a common problem in practice.
842 if (EnableUnsafeGlobalsModRefAliasResults)
843 if ((GV1 || GV2) && GV1 != GV2)
844 return AliasResult::NoAlias;
845
846 // Check for a special case where a non-escaping global can be used to
847 // conclude no-alias.
848 if ((GV1 || GV2) && GV1 != GV2) {
849 const GlobalValue *GV = GV1 ? GV1 : GV2;
850 const Value *UV = GV1 ? UV2 : UV1;
851 if (isNonEscapingGlobalNoAlias(GV, V: UV))
852 return AliasResult::NoAlias;
853 }
854
855 // Otherwise if they are both derived from the same addr-taken global, we
856 // can't know the two accesses don't overlap.
857 }
858
859 // These pointers may be based on the memory owned by an indirect global. If
860 // so, we may be able to handle this. First check to see if the base pointer
861 // is a direct load from an indirect global.
862 GV1 = GV2 = nullptr;
863 if (const LoadInst *LI = dyn_cast<LoadInst>(Val: UV1))
864 if (GlobalVariable *GV = dyn_cast<GlobalVariable>(Val: LI->getOperand(i_nocapture: 0)))
865 if (IndirectGlobals.count(Ptr: GV))
866 GV1 = GV;
867 if (const LoadInst *LI = dyn_cast<LoadInst>(Val: UV2))
868 if (const GlobalVariable *GV = dyn_cast<GlobalVariable>(Val: LI->getOperand(i_nocapture: 0)))
869 if (IndirectGlobals.count(Ptr: GV))
870 GV2 = GV;
871
872 // These pointers may also be from an allocation for the indirect global. If
873 // so, also handle them.
874 if (!GV1)
875 GV1 = AllocsForIndirectGlobals.lookup(Val: UV1);
876 if (!GV2)
877 GV2 = AllocsForIndirectGlobals.lookup(Val: UV2);
878
879 // Now that we know whether the two pointers are related to indirect globals,
880 // use this to disambiguate the pointers. If the pointers are based on
881 // different indirect globals they cannot alias.
882 if (GV1 && GV2 && GV1 != GV2)
883 return AliasResult::NoAlias;
884
885 // If one is based on an indirect global and the other isn't, it isn't
886 // strictly safe but we can fake this result if necessary for performance.
887 // This does not appear to be a common problem in practice.
888 if (EnableUnsafeGlobalsModRefAliasResults)
889 if ((GV1 || GV2) && GV1 != GV2)
890 return AliasResult::NoAlias;
891
892 return AliasResult::MayAlias;
893}
894
895ModRefInfo GlobalsAAResult::getModRefInfoForArgument(const CallBase *Call,
896 const GlobalValue *GV,
897 AAQueryInfo &AAQI) {
898 if (Call->doesNotAccessMemory())
899 return ModRefInfo::NoModRef;
900 ModRefInfo ConservativeResult =
901 Call->onlyReadsMemory() ? ModRefInfo::Ref : ModRefInfo::ModRef;
902
903 // Iterate through all the arguments to the called function. If any argument
904 // is based on GV, return the conservative result.
905 for (const auto &A : Call->args()) {
906 SmallVector<const Value*, 4> Objects;
907 getUnderlyingObjects(V: A, Objects);
908
909 // All objects must be identified.
910 if (!all_of(Range&: Objects, P: isIdentifiedObject) &&
911 // Try ::alias to see if all objects are known not to alias GV.
912 !all_of(Range&: Objects, P: [&](const Value *V) {
913 return this->alias(LocA: MemoryLocation::getBeforeOrAfter(Ptr: V),
914 LocB: MemoryLocation::getBeforeOrAfter(Ptr: GV), AAQI,
915 nullptr) == AliasResult::NoAlias;
916 }))
917 return ConservativeResult;
918
919 if (is_contained(Range&: Objects, Element: GV))
920 return ConservativeResult;
921 }
922
923 // We identified all objects in the argument list, and none of them were GV.
924 return ModRefInfo::NoModRef;
925}
926
927ModRefInfo GlobalsAAResult::getModRefInfo(const CallBase *Call,
928 const MemoryLocation &Loc,
929 AAQueryInfo &AAQI) {
930 ModRefInfo Known = ModRefInfo::ModRef;
931
932 // If we are asking for mod/ref info of a direct call with a pointer to a
933 // global we are tracking, return information if we have it.
934 if (const GlobalValue *GV =
935 dyn_cast<GlobalValue>(Val: getUnderlyingObject(V: Loc.Ptr)))
936 // If GV is internal to this IR and there is no function with local linkage
937 // that has had their address taken, keep looking for a tighter ModRefInfo.
938 if (GV->hasLocalLinkage() && !UnknownFunctionsWithLocalLinkage)
939 if (const Function *F = Call->getCalledFunction())
940 if (NonAddressTakenGlobals.count(Ptr: GV))
941 if (const FunctionInfo *FI = getFunctionInfo(F))
942 Known = FI->getModRefInfoForGlobal(GV: *GV) |
943 getModRefInfoForArgument(Call, GV, AAQI);
944
945 return Known;
946}
947
948GlobalsAAResult::GlobalsAAResult(
949 const DataLayout &DL,
950 std::function<const TargetLibraryInfo &(Function &F)> GetTLI)
951 : DL(DL), GetTLI(std::move(GetTLI)) {}
952
953GlobalsAAResult::GlobalsAAResult(GlobalsAAResult &&Arg)
954 : AAResultBase(std::move(Arg)), DL(Arg.DL), GetTLI(std::move(Arg.GetTLI)),
955 NonAddressTakenGlobals(std::move(Arg.NonAddressTakenGlobals)),
956 IndirectGlobals(std::move(Arg.IndirectGlobals)),
957 AllocsForIndirectGlobals(std::move(Arg.AllocsForIndirectGlobals)),
958 FunctionInfos(std::move(Arg.FunctionInfos)),
959 Handles(std::move(Arg.Handles)) {
960 // Update the parent for each DeletionCallbackHandle.
961 for (auto &H : Handles) {
962 assert(H.GAR == &Arg);
963 H.GAR = this;
964 }
965}
966
967GlobalsAAResult::~GlobalsAAResult() = default;
968
969/*static*/ GlobalsAAResult GlobalsAAResult::analyzeModule(
970 Module &M, std::function<const TargetLibraryInfo &(Function &F)> GetTLI,
971 CallGraph &CG) {
972 GlobalsAAResult Result(M.getDataLayout(), GetTLI);
973
974 // Discover which functions aren't recursive, to feed into AnalyzeGlobals.
975 Result.CollectSCCMembership(CG);
976
977 // Find non-addr taken globals.
978 Result.AnalyzeGlobals(M);
979
980 // Propagate on CG.
981 Result.AnalyzeCallGraph(CG, M);
982
983 return Result;
984}
985
986AnalysisKey GlobalsAA::Key;
987
988GlobalsAAResult GlobalsAA::run(Module &M, ModuleAnalysisManager &AM) {
989 FunctionAnalysisManager &FAM =
990 AM.getResult<FunctionAnalysisManagerModuleProxy>(IR&: M).getManager();
991 auto GetTLI = [&FAM](Function &F) -> TargetLibraryInfo & {
992 return FAM.getResult<TargetLibraryAnalysis>(IR&: F);
993 };
994 return GlobalsAAResult::analyzeModule(M, GetTLI,
995 CG&: AM.getResult<CallGraphAnalysis>(IR&: M));
996}
997
998PreservedAnalyses RecomputeGlobalsAAPass::run(Module &M,
999 ModuleAnalysisManager &AM) {
1000 if (auto *G = AM.getCachedResult<GlobalsAA>(IR&: M)) {
1001 auto &CG = AM.getResult<CallGraphAnalysis>(IR&: M);
1002 G->NonAddressTakenGlobals.clear();
1003 G->UnknownFunctionsWithLocalLinkage = false;
1004 G->IndirectGlobals.clear();
1005 G->AllocsForIndirectGlobals.clear();
1006 G->FunctionInfos.clear();
1007 G->FunctionToSCCMap.clear();
1008 G->Handles.clear();
1009 G->CollectSCCMembership(CG);
1010 G->AnalyzeGlobals(M);
1011 G->AnalyzeCallGraph(CG, M);
1012 }
1013 return PreservedAnalyses::all();
1014}
1015
1016char GlobalsAAWrapperPass::ID = 0;
1017INITIALIZE_PASS_BEGIN(GlobalsAAWrapperPass, "globals-aa",
1018 "Globals Alias Analysis", false, true)
1019INITIALIZE_PASS_DEPENDENCY(CallGraphWrapperPass)
1020INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass)
1021INITIALIZE_PASS_END(GlobalsAAWrapperPass, "globals-aa",
1022 "Globals Alias Analysis", false, true)
1023
1024ModulePass *llvm::createGlobalsAAWrapperPass() {
1025 return new GlobalsAAWrapperPass();
1026}
1027
1028GlobalsAAWrapperPass::GlobalsAAWrapperPass() : ModulePass(ID) {
1029 initializeGlobalsAAWrapperPassPass(Registry&: *PassRegistry::getPassRegistry());
1030}
1031
1032bool GlobalsAAWrapperPass::runOnModule(Module &M) {
1033 auto GetTLI = [this](Function &F) -> TargetLibraryInfo & {
1034 return this->getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(F);
1035 };
1036 Result.reset(p: new GlobalsAAResult(GlobalsAAResult::analyzeModule(
1037 M, GetTLI, CG&: getAnalysis<CallGraphWrapperPass>().getCallGraph())));
1038 return false;
1039}
1040
1041bool GlobalsAAWrapperPass::doFinalization(Module &M) {
1042 Result.reset();
1043 return false;
1044}
1045
1046void GlobalsAAWrapperPass::getAnalysisUsage(AnalysisUsage &AU) const {
1047 AU.setPreservesAll();
1048 AU.addRequired<CallGraphWrapperPass>();
1049 AU.addRequired<TargetLibraryInfoWrapperPass>();
1050}
1051

source code of llvm/lib/Analysis/GlobalsModRef.cpp