1//===- GlobalsModRef.cpp - Simple Mod/Ref Analysis for Globals ------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This simple pass provides alias and mod/ref information for global values
10// that do not have their address taken, and keeps track of whether functions
11// read or write memory (are "pure"). For this simple (but very common) case,
12// we can provide pretty accurate and useful information.
13//
14//===----------------------------------------------------------------------===//
15
16#include "llvm/Analysis/GlobalsModRef.h"
17#include "llvm/ADT/SCCIterator.h"
18#include "llvm/ADT/SmallPtrSet.h"
19#include "llvm/ADT/Statistic.h"
20#include "llvm/Analysis/CallGraph.h"
21#include "llvm/Analysis/MemoryBuiltins.h"
22#include "llvm/Analysis/TargetLibraryInfo.h"
23#include "llvm/Analysis/ValueTracking.h"
24#include "llvm/IR/Constants.h"
25#include "llvm/IR/InstIterator.h"
26#include "llvm/IR/Instructions.h"
27#include "llvm/IR/Module.h"
28#include "llvm/IR/PassManager.h"
29#include "llvm/InitializePasses.h"
30#include "llvm/Pass.h"
31#include "llvm/Support/CommandLine.h"
32
33using namespace llvm;
34
35#define DEBUG_TYPE "globalsmodref-aa"
36
37STATISTIC(NumNonAddrTakenGlobalVars,
38 "Number of global vars without address taken");
39STATISTIC(NumNonAddrTakenFunctions,"Number of functions without address taken");
40STATISTIC(NumNoMemFunctions, "Number of functions that do not access memory");
41STATISTIC(NumReadMemFunctions, "Number of functions that only read memory");
42STATISTIC(NumIndirectGlobalVars, "Number of indirect global objects");
43
44// An option to enable unsafe alias results from the GlobalsModRef analysis.
45// When enabled, GlobalsModRef will provide no-alias results which in extremely
46// rare cases may not be conservatively correct. In particular, in the face of
47// transforms which cause asymmetry between how effective getUnderlyingObject
48// is for two pointers, it may produce incorrect results.
49//
50// These unsafe results have been returned by GMR for many years without
51// causing significant issues in the wild and so we provide a mechanism to
52// re-enable them for users of LLVM that have a particular performance
53// sensitivity and no known issues. The option also makes it easy to evaluate
54// the performance impact of these results.
55static cl::opt<bool> EnableUnsafeGlobalsModRefAliasResults(
56 "enable-unsafe-globalsmodref-alias-results", cl::init(Val: false), cl::Hidden);
57
58/// The mod/ref information collected for a particular function.
59///
60/// We collect information about mod/ref behavior of a function here, both in
61/// general and as pertains to specific globals. We only have this detailed
62/// information when we know *something* useful about the behavior. If we
63/// saturate to fully general mod/ref, we remove the info for the function.
64class GlobalsAAResult::FunctionInfo {
65 typedef SmallDenseMap<const GlobalValue *, ModRefInfo, 16> GlobalInfoMapType;
66
67 /// Build a wrapper struct that has 8-byte alignment. All heap allocations
68 /// should provide this much alignment at least, but this makes it clear we
69 /// specifically rely on this amount of alignment.
70 struct alignas(8) AlignedMap {
71 AlignedMap() = default;
72 AlignedMap(const AlignedMap &Arg) = default;
73 GlobalInfoMapType Map;
74 };
75
76 /// Pointer traits for our aligned map.
77 struct AlignedMapPointerTraits {
78 static inline void *getAsVoidPointer(AlignedMap *P) { return P; }
79 static inline AlignedMap *getFromVoidPointer(void *P) {
80 return (AlignedMap *)P;
81 }
82 static constexpr int NumLowBitsAvailable = 3;
83 static_assert(alignof(AlignedMap) >= (1 << NumLowBitsAvailable),
84 "AlignedMap insufficiently aligned to have enough low bits.");
85 };
86
87 /// The bit that flags that this function may read any global. This is
88 /// chosen to mix together with ModRefInfo bits.
89 /// FIXME: This assumes ModRefInfo lattice will remain 4 bits!
90 /// FunctionInfo.getModRefInfo() masks out everything except ModRef so
91 /// this remains correct.
92 enum { MayReadAnyGlobal = 4 };
93
94 /// Checks to document the invariants of the bit packing here.
95 static_assert((MayReadAnyGlobal & static_cast<int>(ModRefInfo::ModRef)) == 0,
96 "ModRef and the MayReadAnyGlobal flag bits overlap.");
97 static_assert(((MayReadAnyGlobal | static_cast<int>(ModRefInfo::ModRef)) >>
98 AlignedMapPointerTraits::NumLowBitsAvailable) == 0,
99 "Insufficient low bits to store our flag and ModRef info.");
100
101public:
102 FunctionInfo() = default;
103 ~FunctionInfo() {
104 delete Info.getPointer();
105 }
106 // Spell out the copy ond move constructors and assignment operators to get
107 // deep copy semantics and correct move semantics in the face of the
108 // pointer-int pair.
109 FunctionInfo(const FunctionInfo &Arg)
110 : Info(nullptr, Arg.Info.getInt()) {
111 if (const auto *ArgPtr = Arg.Info.getPointer())
112 Info.setPointer(new AlignedMap(*ArgPtr));
113 }
114 FunctionInfo(FunctionInfo &&Arg)
115 : Info(Arg.Info.getPointer(), Arg.Info.getInt()) {
116 Arg.Info.setPointerAndInt(PtrVal: nullptr, IntVal: 0);
117 }
118 FunctionInfo &operator=(const FunctionInfo &RHS) {
119 delete Info.getPointer();
120 Info.setPointerAndInt(PtrVal: nullptr, IntVal: RHS.Info.getInt());
121 if (const auto *RHSPtr = RHS.Info.getPointer())
122 Info.setPointer(new AlignedMap(*RHSPtr));
123 return *this;
124 }
125 FunctionInfo &operator=(FunctionInfo &&RHS) {
126 delete Info.getPointer();
127 Info.setPointerAndInt(PtrVal: RHS.Info.getPointer(), IntVal: RHS.Info.getInt());
128 RHS.Info.setPointerAndInt(PtrVal: nullptr, IntVal: 0);
129 return *this;
130 }
131
132 /// This method clears MayReadAnyGlobal bit added by GlobalsAAResult to return
133 /// the corresponding ModRefInfo.
134 ModRefInfo globalClearMayReadAnyGlobal(int I) const {
135 return ModRefInfo(I & static_cast<int>(ModRefInfo::ModRef));
136 }
137
138 /// Returns the \c ModRefInfo info for this function.
139 ModRefInfo getModRefInfo() const {
140 return globalClearMayReadAnyGlobal(I: Info.getInt());
141 }
142
143 /// Adds new \c ModRefInfo for this function to its state.
144 void addModRefInfo(ModRefInfo NewMRI) {
145 Info.setInt(Info.getInt() | static_cast<int>(NewMRI));
146 }
147
148 /// Returns whether this function may read any global variable, and we don't
149 /// know which global.
150 bool mayReadAnyGlobal() const { return Info.getInt() & MayReadAnyGlobal; }
151
152 /// Sets this function as potentially reading from any global.
153 void setMayReadAnyGlobal() { Info.setInt(Info.getInt() | MayReadAnyGlobal); }
154
155 /// Returns the \c ModRefInfo info for this function w.r.t. a particular
156 /// global, which may be more precise than the general information above.
157 ModRefInfo getModRefInfoForGlobal(const GlobalValue &GV) const {
158 ModRefInfo GlobalMRI =
159 mayReadAnyGlobal() ? ModRefInfo::Ref : ModRefInfo::NoModRef;
160 if (AlignedMap *P = Info.getPointer()) {
161 auto I = P->Map.find(Val: &GV);
162 if (I != P->Map.end())
163 GlobalMRI |= I->second;
164 }
165 return GlobalMRI;
166 }
167
168 /// Add mod/ref info from another function into ours, saturating towards
169 /// ModRef.
170 void addFunctionInfo(const FunctionInfo &FI) {
171 addModRefInfo(NewMRI: FI.getModRefInfo());
172
173 if (FI.mayReadAnyGlobal())
174 setMayReadAnyGlobal();
175
176 if (AlignedMap *P = FI.Info.getPointer())
177 for (const auto &G : P->Map)
178 addModRefInfoForGlobal(GV: *G.first, NewMRI: G.second);
179 }
180
181 void addModRefInfoForGlobal(const GlobalValue &GV, ModRefInfo NewMRI) {
182 AlignedMap *P = Info.getPointer();
183 if (!P) {
184 P = new AlignedMap();
185 Info.setPointer(P);
186 }
187 auto &GlobalMRI = P->Map[&GV];
188 GlobalMRI |= NewMRI;
189 }
190
191 /// Clear a global's ModRef info. Should be used when a global is being
192 /// deleted.
193 void eraseModRefInfoForGlobal(const GlobalValue &GV) {
194 if (AlignedMap *P = Info.getPointer())
195 P->Map.erase(Val: &GV);
196 }
197
198private:
199 /// All of the information is encoded into a single pointer, with a three bit
200 /// integer in the low three bits. The high bit provides a flag for when this
201 /// function may read any global. The low two bits are the ModRefInfo. And
202 /// the pointer, when non-null, points to a map from GlobalValue to
203 /// ModRefInfo specific to that GlobalValue.
204 PointerIntPair<AlignedMap *, 3, unsigned, AlignedMapPointerTraits> Info;
205};
206
207void GlobalsAAResult::DeletionCallbackHandle::deleted() {
208 Value *V = getValPtr();
209 if (auto *F = dyn_cast<Function>(Val: V))
210 GAR->FunctionInfos.erase(Val: F);
211
212 if (GlobalValue *GV = dyn_cast<GlobalValue>(Val: V)) {
213 if (GAR->NonAddressTakenGlobals.erase(Ptr: GV)) {
214 // This global might be an indirect global. If so, remove it and
215 // remove any AllocRelatedValues for it.
216 if (GAR->IndirectGlobals.erase(Ptr: GV)) {
217 // Remove any entries in AllocsForIndirectGlobals for this global.
218 GAR->AllocsForIndirectGlobals.remove_if(
219 Pred: [GV](const auto &Entry) { return Entry.second == GV; });
220 }
221
222 // Scan the function info we have collected and remove this global
223 // from all of them.
224 for (auto &FIPair : GAR->FunctionInfos)
225 FIPair.second.eraseModRefInfoForGlobal(GV: *GV);
226 }
227 }
228
229 // If this is an allocation related to an indirect global, remove it.
230 GAR->AllocsForIndirectGlobals.erase(Val: V);
231
232 // And clear out the handle.
233 setValPtr(nullptr);
234 GAR->Handles.erase(position: I);
235 // This object is now destroyed!
236}
237
238MemoryEffects GlobalsAAResult::getMemoryEffects(const Function *F) {
239 if (FunctionInfo *FI = getFunctionInfo(F))
240 return MemoryEffects(FI->getModRefInfo());
241
242 return MemoryEffects::unknown();
243}
244
245/// Returns the function info for the function, or null if we don't have
246/// anything useful to say about it.
247GlobalsAAResult::FunctionInfo *
248GlobalsAAResult::getFunctionInfo(const Function *F) {
249 auto I = FunctionInfos.find(Val: F);
250 if (I != FunctionInfos.end())
251 return &I->second;
252 return nullptr;
253}
254
255/// AnalyzeGlobals - Scan through the users of all of the internal
256/// GlobalValue's in the program. If none of them have their "address taken"
257/// (really, their address passed to something nontrivial), record this fact,
258/// and record the functions that they are used directly in.
259void GlobalsAAResult::AnalyzeGlobals(Module &M) {
260 SmallPtrSet<Function *, 32> TrackedFunctions;
261 for (Function &F : M)
262 if (F.hasLocalLinkage()) {
263 if (!AnalyzeUsesOfPointer(V: &F)) {
264 // Remember that we are tracking this global.
265 NonAddressTakenGlobals.insert(Ptr: &F);
266 TrackedFunctions.insert(Ptr: &F);
267 Handles.emplace_front(args&: *this, args: &F);
268 Handles.front().I = Handles.begin();
269 ++NumNonAddrTakenFunctions;
270 } else
271 UnknownFunctionsWithLocalLinkage = true;
272 }
273
274 SmallPtrSet<Function *, 16> Readers, Writers;
275 for (GlobalVariable &GV : M.globals())
276 if (GV.hasLocalLinkage()) {
277 if (!AnalyzeUsesOfPointer(V: &GV, Readers: &Readers,
278 Writers: GV.isConstant() ? nullptr : &Writers)) {
279 // Remember that we are tracking this global, and the mod/ref fns
280 NonAddressTakenGlobals.insert(Ptr: &GV);
281 Handles.emplace_front(args&: *this, args: &GV);
282 Handles.front().I = Handles.begin();
283
284 for (Function *Reader : Readers) {
285 if (TrackedFunctions.insert(Ptr: Reader).second) {
286 Handles.emplace_front(args&: *this, args&: Reader);
287 Handles.front().I = Handles.begin();
288 }
289 FunctionInfos[Reader].addModRefInfoForGlobal(GV, NewMRI: ModRefInfo::Ref);
290 }
291
292 if (!GV.isConstant()) // No need to keep track of writers to constants
293 for (Function *Writer : Writers) {
294 if (TrackedFunctions.insert(Ptr: Writer).second) {
295 Handles.emplace_front(args&: *this, args&: Writer);
296 Handles.front().I = Handles.begin();
297 }
298 FunctionInfos[Writer].addModRefInfoForGlobal(GV, NewMRI: ModRefInfo::Mod);
299 }
300 ++NumNonAddrTakenGlobalVars;
301
302 // If this global holds a pointer type, see if it is an indirect global.
303 if (GV.getValueType()->isPointerTy() &&
304 AnalyzeIndirectGlobalMemory(GV: &GV))
305 ++NumIndirectGlobalVars;
306 }
307 Readers.clear();
308 Writers.clear();
309 }
310}
311
312/// AnalyzeUsesOfPointer - Look at all of the users of the specified pointer.
313/// If this is used by anything complex (i.e., the address escapes), return
314/// true. Also, while we are at it, keep track of those functions that read and
315/// write to the value.
316///
317/// If OkayStoreDest is non-null, stores into this global are allowed.
318bool GlobalsAAResult::AnalyzeUsesOfPointer(Value *V,
319 SmallPtrSetImpl<Function *> *Readers,
320 SmallPtrSetImpl<Function *> *Writers,
321 GlobalValue *OkayStoreDest) {
322 if (!V->getType()->isPointerTy())
323 return true;
324
325 for (Use &U : V->uses()) {
326 User *I = U.getUser();
327 if (LoadInst *LI = dyn_cast<LoadInst>(Val: I)) {
328 if (Readers)
329 Readers->insert(Ptr: LI->getParent()->getParent());
330 } else if (StoreInst *SI = dyn_cast<StoreInst>(Val: I)) {
331 // Check the pointer operand use of the store.
332 if (&U == &SI->getOperandUse(i: 1)) {
333 if (Writers)
334 Writers->insert(Ptr: SI->getParent()->getParent());
335 } else if (SI->getOperand(i_nocapture: 1) != OkayStoreDest) {
336 return true; // Storing the pointer
337 }
338 } else if (Operator::getOpcode(V: I) == Instruction::GetElementPtr) {
339 if (AnalyzeUsesOfPointer(V: I, Readers, Writers))
340 return true;
341 } else if (Operator::getOpcode(V: I) == Instruction::BitCast ||
342 Operator::getOpcode(V: I) == Instruction::AddrSpaceCast) {
343 if (AnalyzeUsesOfPointer(V: I, Readers, Writers, OkayStoreDest))
344 return true;
345 } else if (auto *Call = dyn_cast<CallBase>(Val: I)) {
346 if (IntrinsicInst *II = dyn_cast<IntrinsicInst>(Val: I)) {
347 if (II->getIntrinsicID() == Intrinsic::threadlocal_address &&
348 V == II->getArgOperand(i: 0)) {
349 if (AnalyzeUsesOfPointer(V: II, Readers, Writers))
350 return true;
351 continue;
352 }
353 }
354 // Make sure that this is just the function being called, not that it is
355 // passing into the function.
356 if (Call->isDataOperand(U: &U)) {
357 // Detect calls to free.
358 if (Call->isArgOperand(U: &U) &&
359 getFreedOperand(CB: Call, TLI: &GetTLI(*Call->getFunction())) == U) {
360 if (Writers)
361 Writers->insert(Ptr: Call->getParent()->getParent());
362 } else {
363 // In general, we return true for unknown calls, but there are
364 // some simple checks that we can do for functions that
365 // will never call back into the module.
366 auto *F = Call->getCalledFunction();
367 // TODO: we should be able to remove isDeclaration() check
368 // and let the function body analysis check for captures,
369 // and collect the mod-ref effects. This information will
370 // be later propagated via the call graph.
371 if (!F || !F->isDeclaration())
372 return true;
373 // Note that the NoCallback check here is a little bit too
374 // conservative. If there are no captures of the global
375 // in the module, then this call may not be a capture even
376 // if it does not have NoCallback.
377 if (!Call->hasFnAttr(Kind: Attribute::NoCallback) ||
378 !Call->isArgOperand(U: &U) ||
379 !Call->doesNotCapture(OpNo: Call->getArgOperandNo(U: &U)))
380 return true;
381
382 // Conservatively, assume the call reads and writes the global.
383 // We could use memory attributes to make it more precise.
384 if (Readers)
385 Readers->insert(Ptr: Call->getParent()->getParent());
386 if (Writers)
387 Writers->insert(Ptr: Call->getParent()->getParent());
388 }
389 }
390 } else if (ICmpInst *ICI = dyn_cast<ICmpInst>(Val: I)) {
391 if (!isa<ConstantPointerNull>(Val: ICI->getOperand(i_nocapture: 1)))
392 return true; // Allow comparison against null.
393 } else if (Constant *C = dyn_cast<Constant>(Val: I)) {
394 // Ignore constants which don't have any live uses.
395 if (isa<GlobalValue>(Val: C) || C->isConstantUsed())
396 return true;
397 } else {
398 return true;
399 }
400 }
401
402 return false;
403}
404
405/// AnalyzeIndirectGlobalMemory - We found an non-address-taken global variable
406/// which holds a pointer type. See if the global always points to non-aliased
407/// heap memory: that is, all initializers of the globals store a value known
408/// to be obtained via a noalias return function call which have no other use.
409/// Further, all loads out of GV must directly use the memory, not store the
410/// pointer somewhere. If this is true, we consider the memory pointed to by
411/// GV to be owned by GV and can disambiguate other pointers from it.
412bool GlobalsAAResult::AnalyzeIndirectGlobalMemory(GlobalVariable *GV) {
413 // Keep track of values related to the allocation of the memory, f.e. the
414 // value produced by the noalias call and any casts.
415 std::vector<Value *> AllocRelatedValues;
416
417 // If the initializer is a non-null pointer, bail.
418 if (Constant *C = GV->getInitializer())
419 if (!isa<ConstantPointerNull>(Val: C))
420 return false;
421
422 // Walk the user list of the global. If we find anything other than a direct
423 // load or store, bail out.
424 for (User *U : GV->users()) {
425 if (LoadInst *LI = dyn_cast<LoadInst>(Val: U)) {
426 // The pointer loaded from the global can only be used in simple ways:
427 // we allow addressing of it and loading storing to it. We do *not* allow
428 // storing the loaded pointer somewhere else or passing to a function.
429 if (AnalyzeUsesOfPointer(V: LI))
430 return false; // Loaded pointer escapes.
431 // TODO: Could try some IP mod/ref of the loaded pointer.
432 } else if (StoreInst *SI = dyn_cast<StoreInst>(Val: U)) {
433 // Storing the global itself.
434 if (SI->getOperand(i_nocapture: 0) == GV)
435 return false;
436
437 // If storing the null pointer, ignore it.
438 if (isa<ConstantPointerNull>(Val: SI->getOperand(i_nocapture: 0)))
439 continue;
440
441 // Check the value being stored.
442 Value *Ptr = getUnderlyingObject(V: SI->getOperand(i_nocapture: 0));
443
444 if (!isNoAliasCall(V: Ptr))
445 return false; // Too hard to analyze.
446
447 // Analyze all uses of the allocation. If any of them are used in a
448 // non-simple way (e.g. stored to another global) bail out.
449 if (AnalyzeUsesOfPointer(V: Ptr, /*Readers*/ nullptr, /*Writers*/ nullptr,
450 OkayStoreDest: GV))
451 return false; // Loaded pointer escapes.
452
453 // Remember that this allocation is related to the indirect global.
454 AllocRelatedValues.push_back(x: Ptr);
455 } else {
456 // Something complex, bail out.
457 return false;
458 }
459 }
460
461 // Okay, this is an indirect global. Remember all of the allocations for
462 // this global in AllocsForIndirectGlobals.
463 while (!AllocRelatedValues.empty()) {
464 AllocsForIndirectGlobals[AllocRelatedValues.back()] = GV;
465 Handles.emplace_front(args&: *this, args&: AllocRelatedValues.back());
466 Handles.front().I = Handles.begin();
467 AllocRelatedValues.pop_back();
468 }
469 IndirectGlobals.insert(Ptr: GV);
470 Handles.emplace_front(args&: *this, args&: GV);
471 Handles.front().I = Handles.begin();
472 return true;
473}
474
475void GlobalsAAResult::CollectSCCMembership(CallGraph &CG) {
476 // We do a bottom-up SCC traversal of the call graph. In other words, we
477 // visit all callees before callers (leaf-first).
478 unsigned SCCID = 0;
479 for (scc_iterator<CallGraph *> I = scc_begin(G: &CG); !I.isAtEnd(); ++I) {
480 const std::vector<CallGraphNode *> &SCC = *I;
481 assert(!SCC.empty() && "SCC with no functions?");
482
483 for (auto *CGN : SCC)
484 if (Function *F = CGN->getFunction())
485 FunctionToSCCMap[F] = SCCID;
486 ++SCCID;
487 }
488}
489
490/// AnalyzeCallGraph - At this point, we know the functions where globals are
491/// immediately stored to and read from. Propagate this information up the call
492/// graph to all callers and compute the mod/ref info for all memory for each
493/// function.
494void GlobalsAAResult::AnalyzeCallGraph(CallGraph &CG, Module &M) {
495 // We do a bottom-up SCC traversal of the call graph. In other words, we
496 // visit all callees before callers (leaf-first).
497 for (scc_iterator<CallGraph *> I = scc_begin(G: &CG); !I.isAtEnd(); ++I) {
498 const std::vector<CallGraphNode *> &SCC = *I;
499 assert(!SCC.empty() && "SCC with no functions?");
500
501 Function *F = SCC[0]->getFunction();
502
503 if (!F || !F->isDefinitionExact()) {
504 // Calls externally or not exact - can't say anything useful. Remove any
505 // existing function records (may have been created when scanning
506 // globals).
507 for (auto *Node : SCC)
508 FunctionInfos.erase(Val: Node->getFunction());
509 continue;
510 }
511
512 FunctionInfo &FI = FunctionInfos[F];
513 Handles.emplace_front(args&: *this, args&: F);
514 Handles.front().I = Handles.begin();
515 bool KnowNothing = false;
516
517 // Intrinsics, like any other synchronizing function, can make effects
518 // of other threads visible. Without nosync we know nothing really.
519 // Similarly, if `nocallback` is missing the function, or intrinsic,
520 // can call into the module arbitrarily. If both are set the function
521 // has an effect but will not interact with accesses of internal
522 // globals inside the module. We are conservative here for optnone
523 // functions, might not be necessary.
524 auto MaySyncOrCallIntoModule = [](const Function &F) {
525 return !F.isDeclaration() || !F.hasNoSync() ||
526 !F.hasFnAttribute(Kind: Attribute::NoCallback);
527 };
528
529 // Collect the mod/ref properties due to called functions. We only compute
530 // one mod-ref set.
531 for (unsigned i = 0, e = SCC.size(); i != e && !KnowNothing; ++i) {
532 if (!F) {
533 KnowNothing = true;
534 break;
535 }
536
537 if (F->isDeclaration() || F->hasOptNone()) {
538 // Try to get mod/ref behaviour from function attributes.
539 if (F->doesNotAccessMemory()) {
540 // Can't do better than that!
541 } else if (F->onlyReadsMemory()) {
542 FI.addModRefInfo(NewMRI: ModRefInfo::Ref);
543 if (!F->onlyAccessesArgMemory() && MaySyncOrCallIntoModule(*F))
544 // This function might call back into the module and read a global -
545 // consider every global as possibly being read by this function.
546 FI.setMayReadAnyGlobal();
547 } else {
548 FI.addModRefInfo(NewMRI: ModRefInfo::ModRef);
549 if (!F->onlyAccessesArgMemory())
550 FI.setMayReadAnyGlobal();
551 if (MaySyncOrCallIntoModule(*F)) {
552 KnowNothing = true;
553 break;
554 }
555 }
556 continue;
557 }
558
559 for (CallGraphNode::iterator CI = SCC[i]->begin(), E = SCC[i]->end();
560 CI != E && !KnowNothing; ++CI)
561 if (Function *Callee = CI->second->getFunction()) {
562 if (FunctionInfo *CalleeFI = getFunctionInfo(F: Callee)) {
563 // Propagate function effect up.
564 FI.addFunctionInfo(FI: *CalleeFI);
565 } else {
566 // Can't say anything about it. However, if it is inside our SCC,
567 // then nothing needs to be done.
568 CallGraphNode *CalleeNode = CG[Callee];
569 if (!is_contained(Range: SCC, Element: CalleeNode))
570 KnowNothing = true;
571 }
572 } else {
573 KnowNothing = true;
574 }
575 }
576
577 // If we can't say anything useful about this SCC, remove all SCC functions
578 // from the FunctionInfos map.
579 if (KnowNothing) {
580 for (auto *Node : SCC)
581 FunctionInfos.erase(Val: Node->getFunction());
582 continue;
583 }
584
585 // Scan the function bodies for explicit loads or stores.
586 for (auto *Node : SCC) {
587 if (isModAndRefSet(MRI: FI.getModRefInfo()))
588 break; // The mod/ref lattice saturates here.
589
590 // Don't prove any properties based on the implementation of an optnone
591 // function. Function attributes were already used as a best approximation
592 // above.
593 if (Node->getFunction()->hasOptNone())
594 continue;
595
596 for (Instruction &I : instructions(F: Node->getFunction())) {
597 if (isModAndRefSet(MRI: FI.getModRefInfo()))
598 break; // The mod/ref lattice saturates here.
599
600 // We handle calls specially because the graph-relevant aspects are
601 // handled above.
602 if (isa<CallBase>(Val: &I))
603 continue;
604
605 // All non-call instructions we use the primary predicates for whether
606 // they read or write memory.
607 if (I.mayReadFromMemory())
608 FI.addModRefInfo(NewMRI: ModRefInfo::Ref);
609 if (I.mayWriteToMemory())
610 FI.addModRefInfo(NewMRI: ModRefInfo::Mod);
611 }
612 }
613
614 if (!isModSet(MRI: FI.getModRefInfo()))
615 ++NumReadMemFunctions;
616 if (!isModOrRefSet(MRI: FI.getModRefInfo()))
617 ++NumNoMemFunctions;
618
619 // Finally, now that we know the full effect on this SCC, clone the
620 // information to each function in the SCC.
621 // FI is a reference into FunctionInfos, so copy it now so that it doesn't
622 // get invalidated if DenseMap decides to re-hash.
623 FunctionInfo CachedFI = FI;
624 for (unsigned i = 1, e = SCC.size(); i != e; ++i)
625 FunctionInfos[SCC[i]->getFunction()] = CachedFI;
626 }
627}
628
629// GV is a non-escaping global. V is a pointer address that has been loaded from.
630// If we can prove that V must escape, we can conclude that a load from V cannot
631// alias GV.
632static bool isNonEscapingGlobalNoAliasWithLoad(const GlobalValue *GV,
633 const Value *V,
634 int &Depth,
635 const DataLayout &DL) {
636 SmallPtrSet<const Value *, 8> Visited;
637 SmallVector<const Value *, 8> Inputs;
638 Visited.insert(Ptr: V);
639 Inputs.push_back(Elt: V);
640 do {
641 const Value *Input = Inputs.pop_back_val();
642
643 if (isa<GlobalValue>(Val: Input) || isa<Argument>(Val: Input) || isa<CallInst>(Val: Input) ||
644 isa<InvokeInst>(Val: Input))
645 // Arguments to functions or returns from functions are inherently
646 // escaping, so we can immediately classify those as not aliasing any
647 // non-addr-taken globals.
648 //
649 // (Transitive) loads from a global are also safe - if this aliased
650 // another global, its address would escape, so no alias.
651 continue;
652
653 // Recurse through a limited number of selects, loads and PHIs. This is an
654 // arbitrary depth of 4, lower numbers could be used to fix compile time
655 // issues if needed, but this is generally expected to be only be important
656 // for small depths.
657 if (++Depth > 4)
658 return false;
659
660 if (auto *LI = dyn_cast<LoadInst>(Val: Input)) {
661 Inputs.push_back(Elt: getUnderlyingObject(V: LI->getPointerOperand()));
662 continue;
663 }
664 if (auto *SI = dyn_cast<SelectInst>(Val: Input)) {
665 const Value *LHS = getUnderlyingObject(V: SI->getTrueValue());
666 const Value *RHS = getUnderlyingObject(V: SI->getFalseValue());
667 if (Visited.insert(Ptr: LHS).second)
668 Inputs.push_back(Elt: LHS);
669 if (Visited.insert(Ptr: RHS).second)
670 Inputs.push_back(Elt: RHS);
671 continue;
672 }
673 if (auto *PN = dyn_cast<PHINode>(Val: Input)) {
674 for (const Value *Op : PN->incoming_values()) {
675 Op = getUnderlyingObject(V: Op);
676 if (Visited.insert(Ptr: Op).second)
677 Inputs.push_back(Elt: Op);
678 }
679 continue;
680 }
681
682 return false;
683 } while (!Inputs.empty());
684
685 // All inputs were known to be no-alias.
686 return true;
687}
688
689// There are particular cases where we can conclude no-alias between
690// a non-addr-taken global and some other underlying object. Specifically,
691// a non-addr-taken global is known to not be escaped from any function. It is
692// also incorrect for a transformation to introduce an escape of a global in
693// a way that is observable when it was not there previously. One function
694// being transformed to introduce an escape which could possibly be observed
695// (via loading from a global or the return value for example) within another
696// function is never safe. If the observation is made through non-atomic
697// operations on different threads, it is a data-race and UB. If the
698// observation is well defined, by being observed the transformation would have
699// changed program behavior by introducing the observed escape, making it an
700// invalid transform.
701//
702// This property does require that transformations which *temporarily* escape
703// a global that was not previously escaped, prior to restoring it, cannot rely
704// on the results of GMR::alias. This seems a reasonable restriction, although
705// currently there is no way to enforce it. There is also no realistic
706// optimization pass that would make this mistake. The closest example is
707// a transformation pass which does reg2mem of SSA values but stores them into
708// global variables temporarily before restoring the global variable's value.
709// This could be useful to expose "benign" races for example. However, it seems
710// reasonable to require that a pass which introduces escapes of global
711// variables in this way to either not trust AA results while the escape is
712// active, or to be forced to operate as a module pass that cannot co-exist
713// with an alias analysis such as GMR.
714bool GlobalsAAResult::isNonEscapingGlobalNoAlias(const GlobalValue *GV,
715 const Value *V,
716 const Instruction *CtxI) {
717 // In order to know that the underlying object cannot alias the
718 // non-addr-taken global, we must know that it would have to be an escape.
719 // Thus if the underlying object is a function argument, a load from
720 // a global, or the return of a function, it cannot alias. We can also
721 // recurse through PHI nodes and select nodes provided all of their inputs
722 // resolve to one of these known-escaping roots.
723
724 // A non-addr-taken global cannot alias with any non-pointer value.
725 // Check this early and exit.
726 if (!V->getType()->isPointerTy())
727 return true;
728
729 SmallPtrSet<const Value *, 8> Visited;
730 SmallVector<const Value *, 8> Inputs;
731 Visited.insert(Ptr: V);
732 Inputs.push_back(Elt: V);
733 int Depth = 0;
734 do {
735 const Value *Input = Inputs.pop_back_val();
736
737 if (auto *InputGV = dyn_cast<GlobalValue>(Val: Input)) {
738 // If one input is the very global we're querying against, then we can't
739 // conclude no-alias.
740 if (InputGV == GV)
741 return false;
742
743 // Distinct GlobalVariables never alias, unless overriden or zero-sized.
744 // FIXME: The condition can be refined, but be conservative for now.
745 auto *GVar = dyn_cast<GlobalVariable>(Val: GV);
746 auto *InputGVar = dyn_cast<GlobalVariable>(Val: InputGV);
747 if (GVar && InputGVar &&
748 !GVar->isDeclaration() && !InputGVar->isDeclaration() &&
749 !GVar->isInterposable() && !InputGVar->isInterposable()) {
750 Type *GVType = GVar->getInitializer()->getType();
751 Type *InputGVType = InputGVar->getInitializer()->getType();
752 if (GVType->isSized() && InputGVType->isSized() &&
753 (DL.getTypeAllocSize(Ty: GVType) > 0) &&
754 (DL.getTypeAllocSize(Ty: InputGVType) > 0))
755 continue;
756 }
757
758 // Conservatively return false, even though we could be smarter
759 // (e.g. look through GlobalAliases).
760 return false;
761 }
762
763 if (isa<Argument>(Val: Input) || isa<CallInst>(Val: Input) ||
764 isa<InvokeInst>(Val: Input)) {
765 // Arguments to functions or returns from functions are inherently
766 // escaping, so we can immediately classify those as not aliasing any
767 // non-addr-taken globals.
768 continue;
769 }
770
771 if (CtxI)
772 if (auto *CPN = dyn_cast<ConstantPointerNull>(Val: Input)) {
773 // Null pointer cannot alias with a non-addr-taken global.
774 const Function *F = CtxI->getFunction();
775 if (!NullPointerIsDefined(F, AS: CPN->getPointerType()->getAddressSpace()))
776 continue;
777 }
778
779 // Recurse through a limited number of selects, loads and PHIs. This is an
780 // arbitrary depth of 4, lower numbers could be used to fix compile time
781 // issues if needed, but this is generally expected to be only be important
782 // for small depths.
783 if (++Depth > 4)
784 return false;
785
786 if (auto *LI = dyn_cast<LoadInst>(Val: Input)) {
787 // A pointer loaded from a global would have been captured, and we know
788 // that the global is non-escaping, so no alias.
789 const Value *Ptr = getUnderlyingObject(V: LI->getPointerOperand());
790 if (isNonEscapingGlobalNoAliasWithLoad(GV, V: Ptr, Depth, DL))
791 // The load does not alias with GV.
792 continue;
793 // Otherwise, a load could come from anywhere, so bail.
794 return false;
795 }
796 if (auto *SI = dyn_cast<SelectInst>(Val: Input)) {
797 const Value *LHS = getUnderlyingObject(V: SI->getTrueValue());
798 const Value *RHS = getUnderlyingObject(V: SI->getFalseValue());
799 if (Visited.insert(Ptr: LHS).second)
800 Inputs.push_back(Elt: LHS);
801 if (Visited.insert(Ptr: RHS).second)
802 Inputs.push_back(Elt: RHS);
803 continue;
804 }
805 if (auto *PN = dyn_cast<PHINode>(Val: Input)) {
806 for (const Value *Op : PN->incoming_values()) {
807 Op = getUnderlyingObject(V: Op);
808 if (Visited.insert(Ptr: Op).second)
809 Inputs.push_back(Elt: Op);
810 }
811 continue;
812 }
813
814 // FIXME: It would be good to handle other obvious no-alias cases here, but
815 // it isn't clear how to do so reasonably without building a small version
816 // of BasicAA into this code.
817 return false;
818 } while (!Inputs.empty());
819
820 // If all the inputs to V were definitively no-alias, then V is no-alias.
821 return true;
822}
823
824bool GlobalsAAResult::invalidate(Module &, const PreservedAnalyses &PA,
825 ModuleAnalysisManager::Invalidator &) {
826 // Check whether the analysis has been explicitly invalidated. Otherwise, it's
827 // stateless and remains preserved.
828 auto PAC = PA.getChecker<GlobalsAA>();
829 return !PAC.preservedWhenStateless();
830}
831
832/// alias - If one of the pointers is to a global that we are tracking, and the
833/// other is some random pointer, we know there cannot be an alias, because the
834/// address of the global isn't taken.
835AliasResult GlobalsAAResult::alias(const MemoryLocation &LocA,
836 const MemoryLocation &LocB,
837 AAQueryInfo &AAQI, const Instruction *CtxI) {
838 // Get the base object these pointers point to.
839 const Value *UV1 =
840 getUnderlyingObject(V: LocA.Ptr->stripPointerCastsForAliasAnalysis());
841 const Value *UV2 =
842 getUnderlyingObject(V: LocB.Ptr->stripPointerCastsForAliasAnalysis());
843
844 // If either of the underlying values is a global, they may be non-addr-taken
845 // globals, which we can answer queries about.
846 const GlobalValue *GV1 = dyn_cast<GlobalValue>(Val: UV1);
847 const GlobalValue *GV2 = dyn_cast<GlobalValue>(Val: UV2);
848 if (GV1 || GV2) {
849 // If the global's address is taken, pretend we don't know it's a pointer to
850 // the global.
851 if (GV1 && !NonAddressTakenGlobals.count(Ptr: GV1))
852 GV1 = nullptr;
853 if (GV2 && !NonAddressTakenGlobals.count(Ptr: GV2))
854 GV2 = nullptr;
855
856 // If the two pointers are derived from two different non-addr-taken
857 // globals we know these can't alias.
858 if (GV1 && GV2 && GV1 != GV2)
859 return AliasResult::NoAlias;
860
861 // If one is and the other isn't, it isn't strictly safe but we can fake
862 // this result if necessary for performance. This does not appear to be
863 // a common problem in practice.
864 if (EnableUnsafeGlobalsModRefAliasResults)
865 if ((GV1 || GV2) && GV1 != GV2)
866 return AliasResult::NoAlias;
867
868 // Check for a special case where a non-escaping global can be used to
869 // conclude no-alias.
870 if ((GV1 || GV2) && GV1 != GV2) {
871 const GlobalValue *GV = GV1 ? GV1 : GV2;
872 const Value *UV = GV1 ? UV2 : UV1;
873 if (isNonEscapingGlobalNoAlias(GV, V: UV, CtxI))
874 return AliasResult::NoAlias;
875 }
876
877 // Otherwise if they are both derived from the same addr-taken global, we
878 // can't know the two accesses don't overlap.
879 }
880
881 // These pointers may be based on the memory owned by an indirect global. If
882 // so, we may be able to handle this. First check to see if the base pointer
883 // is a direct load from an indirect global.
884 GV1 = GV2 = nullptr;
885 if (const LoadInst *LI = dyn_cast<LoadInst>(Val: UV1))
886 if (GlobalVariable *GV = dyn_cast<GlobalVariable>(Val: LI->getOperand(i_nocapture: 0)))
887 if (IndirectGlobals.count(Ptr: GV))
888 GV1 = GV;
889 if (const LoadInst *LI = dyn_cast<LoadInst>(Val: UV2))
890 if (const GlobalVariable *GV = dyn_cast<GlobalVariable>(Val: LI->getOperand(i_nocapture: 0)))
891 if (IndirectGlobals.count(Ptr: GV))
892 GV2 = GV;
893
894 // These pointers may also be from an allocation for the indirect global. If
895 // so, also handle them.
896 if (!GV1)
897 GV1 = AllocsForIndirectGlobals.lookup(Val: UV1);
898 if (!GV2)
899 GV2 = AllocsForIndirectGlobals.lookup(Val: UV2);
900
901 // Now that we know whether the two pointers are related to indirect globals,
902 // use this to disambiguate the pointers. If the pointers are based on
903 // different indirect globals they cannot alias.
904 if (GV1 && GV2 && GV1 != GV2)
905 return AliasResult::NoAlias;
906
907 // If one is based on an indirect global and the other isn't, it isn't
908 // strictly safe but we can fake this result if necessary for performance.
909 // This does not appear to be a common problem in practice.
910 if (EnableUnsafeGlobalsModRefAliasResults)
911 if ((GV1 || GV2) && GV1 != GV2)
912 return AliasResult::NoAlias;
913
914 return AliasResult::MayAlias;
915}
916
917ModRefInfo GlobalsAAResult::getModRefInfoForArgument(const CallBase *Call,
918 const GlobalValue *GV,
919 AAQueryInfo &AAQI) {
920 if (Call->doesNotAccessMemory())
921 return ModRefInfo::NoModRef;
922 ModRefInfo ConservativeResult =
923 Call->onlyReadsMemory() ? ModRefInfo::Ref : ModRefInfo::ModRef;
924
925 // Iterate through all the arguments to the called function. If any argument
926 // is based on GV, return the conservative result.
927 for (const auto &A : Call->args()) {
928 SmallVector<const Value*, 4> Objects;
929 getUnderlyingObjects(V: A, Objects);
930
931 // All objects must be identified.
932 if (!all_of(Range&: Objects, P: isIdentifiedObject) &&
933 // Try ::alias to see if all objects are known not to alias GV.
934 !all_of(Range&: Objects, P: [&](const Value *V) {
935 return this->alias(LocA: MemoryLocation::getBeforeOrAfter(Ptr: V),
936 LocB: MemoryLocation::getBeforeOrAfter(Ptr: GV), AAQI,
937 CtxI: Call) == AliasResult::NoAlias;
938 }))
939 return ConservativeResult;
940
941 if (is_contained(Range&: Objects, Element: GV))
942 return ConservativeResult;
943 }
944
945 // We identified all objects in the argument list, and none of them were GV.
946 return ModRefInfo::NoModRef;
947}
948
949ModRefInfo GlobalsAAResult::getModRefInfo(const CallBase *Call,
950 const MemoryLocation &Loc,
951 AAQueryInfo &AAQI) {
952 ModRefInfo Known = ModRefInfo::ModRef;
953
954 // If we are asking for mod/ref info of a direct call with a pointer to a
955 // global we are tracking, return information if we have it.
956 if (const GlobalValue *GV =
957 dyn_cast<GlobalValue>(Val: getUnderlyingObject(V: Loc.Ptr)))
958 // If GV is internal to this IR and there is no function with local linkage
959 // that has had their address taken, keep looking for a tighter ModRefInfo.
960 if (GV->hasLocalLinkage() && !UnknownFunctionsWithLocalLinkage)
961 if (const Function *F = Call->getCalledFunction())
962 if (NonAddressTakenGlobals.count(Ptr: GV))
963 if (const FunctionInfo *FI = getFunctionInfo(F))
964 Known = FI->getModRefInfoForGlobal(GV: *GV) |
965 getModRefInfoForArgument(Call, GV, AAQI);
966
967 return Known;
968}
969
970GlobalsAAResult::GlobalsAAResult(
971 const DataLayout &DL,
972 std::function<const TargetLibraryInfo &(Function &F)> GetTLI)
973 : DL(DL), GetTLI(std::move(GetTLI)) {}
974
975GlobalsAAResult::GlobalsAAResult(GlobalsAAResult &&Arg)
976 : AAResultBase(std::move(Arg)), DL(Arg.DL), GetTLI(std::move(Arg.GetTLI)),
977 NonAddressTakenGlobals(std::move(Arg.NonAddressTakenGlobals)),
978 IndirectGlobals(std::move(Arg.IndirectGlobals)),
979 AllocsForIndirectGlobals(std::move(Arg.AllocsForIndirectGlobals)),
980 FunctionInfos(std::move(Arg.FunctionInfos)),
981 Handles(std::move(Arg.Handles)) {
982 // Update the parent for each DeletionCallbackHandle.
983 for (auto &H : Handles) {
984 assert(H.GAR == &Arg);
985 H.GAR = this;
986 }
987}
988
989GlobalsAAResult::~GlobalsAAResult() = default;
990
991/*static*/ GlobalsAAResult GlobalsAAResult::analyzeModule(
992 Module &M, std::function<const TargetLibraryInfo &(Function &F)> GetTLI,
993 CallGraph &CG) {
994 GlobalsAAResult Result(M.getDataLayout(), GetTLI);
995
996 // Discover which functions aren't recursive, to feed into AnalyzeGlobals.
997 Result.CollectSCCMembership(CG);
998
999 // Find non-addr taken globals.
1000 Result.AnalyzeGlobals(M);
1001
1002 // Propagate on CG.
1003 Result.AnalyzeCallGraph(CG, M);
1004
1005 return Result;
1006}
1007
1008AnalysisKey GlobalsAA::Key;
1009
1010GlobalsAAResult GlobalsAA::run(Module &M, ModuleAnalysisManager &AM) {
1011 FunctionAnalysisManager &FAM =
1012 AM.getResult<FunctionAnalysisManagerModuleProxy>(IR&: M).getManager();
1013 auto GetTLI = [&FAM](Function &F) -> TargetLibraryInfo & {
1014 return FAM.getResult<TargetLibraryAnalysis>(IR&: F);
1015 };
1016 return GlobalsAAResult::analyzeModule(M, GetTLI,
1017 CG&: AM.getResult<CallGraphAnalysis>(IR&: M));
1018}
1019
1020PreservedAnalyses RecomputeGlobalsAAPass::run(Module &M,
1021 ModuleAnalysisManager &AM) {
1022 if (auto *G = AM.getCachedResult<GlobalsAA>(IR&: M)) {
1023 auto &CG = AM.getResult<CallGraphAnalysis>(IR&: M);
1024 G->NonAddressTakenGlobals.clear();
1025 G->UnknownFunctionsWithLocalLinkage = false;
1026 G->IndirectGlobals.clear();
1027 G->AllocsForIndirectGlobals.clear();
1028 G->FunctionInfos.clear();
1029 G->FunctionToSCCMap.clear();
1030 G->Handles.clear();
1031 G->CollectSCCMembership(CG);
1032 G->AnalyzeGlobals(M);
1033 G->AnalyzeCallGraph(CG, M);
1034 }
1035 return PreservedAnalyses::all();
1036}
1037
1038char GlobalsAAWrapperPass::ID = 0;
1039INITIALIZE_PASS_BEGIN(GlobalsAAWrapperPass, "globals-aa",
1040 "Globals Alias Analysis", false, true)
1041INITIALIZE_PASS_DEPENDENCY(CallGraphWrapperPass)
1042INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass)
1043INITIALIZE_PASS_END(GlobalsAAWrapperPass, "globals-aa",
1044 "Globals Alias Analysis", false, true)
1045
1046ModulePass *llvm::createGlobalsAAWrapperPass() {
1047 return new GlobalsAAWrapperPass();
1048}
1049
1050GlobalsAAWrapperPass::GlobalsAAWrapperPass() : ModulePass(ID) {}
1051
1052bool GlobalsAAWrapperPass::runOnModule(Module &M) {
1053 auto GetTLI = [this](Function &F) -> TargetLibraryInfo & {
1054 return this->getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(F);
1055 };
1056 Result.reset(p: new GlobalsAAResult(GlobalsAAResult::analyzeModule(
1057 M, GetTLI, CG&: getAnalysis<CallGraphWrapperPass>().getCallGraph())));
1058 return false;
1059}
1060
1061bool GlobalsAAWrapperPass::doFinalization(Module &M) {
1062 Result.reset();
1063 return false;
1064}
1065
1066void GlobalsAAWrapperPass::getAnalysisUsage(AnalysisUsage &AU) const {
1067 AU.setPreservesAll();
1068 AU.addRequired<CallGraphWrapperPass>();
1069 AU.addRequired<TargetLibraryInfoWrapperPass>();
1070}
1071