1 //===- GlobalsModRef.cpp - Simple Mod/Ref Analysis for Globals ------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This simple pass provides alias and mod/ref information for global values
11 // that do not have their address taken, and keeps track of whether functions
12 // read or write memory (are "pure"). For this simple (but very common) case,
13 // we can provide pretty accurate and useful information.
15 //===----------------------------------------------------------------------===//
17 #include "llvm/Analysis/Passes.h"
18 #include "llvm/ADT/SCCIterator.h"
19 #include "llvm/ADT/Statistic.h"
20 #include "llvm/Analysis/AliasAnalysis.h"
21 #include "llvm/Analysis/CallGraph.h"
22 #include "llvm/Analysis/MemoryBuiltins.h"
23 #include "llvm/Analysis/ValueTracking.h"
24 #include "llvm/IR/Constants.h"
25 #include "llvm/IR/DerivedTypes.h"
26 #include "llvm/IR/InstIterator.h"
27 #include "llvm/IR/Instructions.h"
28 #include "llvm/IR/IntrinsicInst.h"
29 #include "llvm/IR/Module.h"
30 #include "llvm/Pass.h"
31 #include "llvm/Support/CommandLine.h"
35 #define DEBUG_TYPE "globalsmodref-aa"
37 STATISTIC(NumNonAddrTakenGlobalVars,
38 "Number of global vars without address taken");
39 STATISTIC(NumNonAddrTakenFunctions,"Number of functions without address taken");
40 STATISTIC(NumNoMemFunctions, "Number of functions that do not access memory");
41 STATISTIC(NumReadMemFunctions, "Number of functions that only read memory");
42 STATISTIC(NumIndirectGlobalVars, "Number of indirect global objects");
44 // An option to enable unsafe alias results from the GlobalsModRef analysis.
45 // When enabled, GlobalsModRef will provide no-alias results which in extremely
46 // rare cases may not be conservatively correct. In particular, in the face of
47 // transforms which cause assymetry between how effective GetUnderlyingObject
48 // is for two pointers, it may produce incorrect results.
50 // These unsafe results have been returned by GMR for many years without
51 // causing significant issues in the wild and so we provide a mechanism to
52 // re-enable them for users of LLVM that have a particular performance
53 // sensitivity and no known issues. The option also makes it easy to evaluate
54 // the performance impact of these results.
55 static cl::opt<bool> EnableUnsafeGlobalsModRefAliasResults(
56 "enable-unsafe-globalsmodref-alias-results", cl::init(false), cl::Hidden);
59 /// FunctionRecord - One instance of this structure is stored for every
60 /// function in the program. Later, the entries for these functions are
61 /// removed if the function is found to call an external function (in which
62 /// case we know nothing about it.
63 struct FunctionRecord {
64 /// GlobalInfo - Maintain mod/ref info for all of the globals without
65 /// addresses taken that are read or written (transitively) by this
67 std::map<const GlobalValue *, unsigned> GlobalInfo;
69 /// MayReadAnyGlobal - May read global variables, but it is not known which.
70 bool MayReadAnyGlobal;
72 unsigned getInfoForGlobal(const GlobalValue *GV) const {
73 unsigned Effect = MayReadAnyGlobal ? AliasAnalysis::Ref : 0;
74 std::map<const GlobalValue *, unsigned>::const_iterator I =
76 if (I != GlobalInfo.end())
81 /// FunctionEffect - Capture whether or not this function reads or writes to
82 /// ANY memory. If not, we can do a lot of aggressive analysis on it.
83 unsigned FunctionEffect;
85 FunctionRecord() : MayReadAnyGlobal(false), FunctionEffect(0) {}
88 /// GlobalsModRef - The actual analysis pass.
89 class GlobalsModRef : public ModulePass, public AliasAnalysis {
90 /// NonAddressTakenGlobals - The globals that do not have their addresses
92 std::set<const GlobalValue *> NonAddressTakenGlobals;
94 /// IndirectGlobals - The memory pointed to by this global is known to be
95 /// 'owned' by the global.
96 std::set<const GlobalValue *> IndirectGlobals;
98 /// AllocsForIndirectGlobals - If an instruction allocates memory for an
99 /// indirect global, this map indicates which one.
100 std::map<const Value *, const GlobalValue *> AllocsForIndirectGlobals;
102 /// FunctionInfo - For each function, keep track of what globals are
103 /// modified or read.
104 std::map<const Function *, FunctionRecord> FunctionInfo;
108 GlobalsModRef() : ModulePass(ID) {
109 initializeGlobalsModRefPass(*PassRegistry::getPassRegistry());
112 bool runOnModule(Module &M) override {
113 InitializeAliasAnalysis(this, &M.getDataLayout());
115 // Find non-addr taken globals.
119 AnalyzeCallGraph(getAnalysis<CallGraphWrapperPass>().getCallGraph(), M);
123 void getAnalysisUsage(AnalysisUsage &AU) const override {
124 AliasAnalysis::getAnalysisUsage(AU);
125 AU.addRequired<CallGraphWrapperPass>();
126 AU.setPreservesAll(); // Does not transform code
129 //------------------------------------------------
130 // Implement the AliasAnalysis API
132 AliasResult alias(const MemoryLocation &LocA,
133 const MemoryLocation &LocB) override;
134 ModRefResult getModRefInfo(ImmutableCallSite CS,
135 const MemoryLocation &Loc) override;
136 ModRefResult getModRefInfo(ImmutableCallSite CS1,
137 ImmutableCallSite CS2) override {
138 return AliasAnalysis::getModRefInfo(CS1, CS2);
141 /// getModRefBehavior - Return the behavior of the specified function if
142 /// called from the specified call site. The call site may be null in which
143 /// case the most generic behavior of this function should be returned.
144 ModRefBehavior getModRefBehavior(const Function *F) override {
145 ModRefBehavior Min = UnknownModRefBehavior;
147 if (FunctionRecord *FR = getFunctionInfo(F)) {
148 if (FR->FunctionEffect == 0)
149 Min = DoesNotAccessMemory;
150 else if ((FR->FunctionEffect & Mod) == 0)
151 Min = OnlyReadsMemory;
154 return ModRefBehavior(AliasAnalysis::getModRefBehavior(F) & Min);
157 /// getModRefBehavior - Return the behavior of the specified function if
158 /// called from the specified call site. The call site may be null in which
159 /// case the most generic behavior of this function should be returned.
160 ModRefBehavior getModRefBehavior(ImmutableCallSite CS) override {
161 ModRefBehavior Min = UnknownModRefBehavior;
163 if (const Function *F = CS.getCalledFunction())
164 if (FunctionRecord *FR = getFunctionInfo(F)) {
165 if (FR->FunctionEffect == 0)
166 Min = DoesNotAccessMemory;
167 else if ((FR->FunctionEffect & Mod) == 0)
168 Min = OnlyReadsMemory;
171 return ModRefBehavior(AliasAnalysis::getModRefBehavior(CS) & Min);
174 void deleteValue(Value *V) override;
176 /// getAdjustedAnalysisPointer - This method is used when a pass implements
177 /// an analysis interface through multiple inheritance. If needed, it
178 /// should override this to adjust the this pointer as needed for the
179 /// specified pass info.
180 void *getAdjustedAnalysisPointer(AnalysisID PI) override {
181 if (PI == &AliasAnalysis::ID)
182 return (AliasAnalysis *)this;
187 /// getFunctionInfo - Return the function info for the function, or null if
188 /// we don't have anything useful to say about it.
189 FunctionRecord *getFunctionInfo(const Function *F) {
190 std::map<const Function *, FunctionRecord>::iterator I =
191 FunctionInfo.find(F);
192 if (I != FunctionInfo.end())
197 void AnalyzeGlobals(Module &M);
198 void AnalyzeCallGraph(CallGraph &CG, Module &M);
199 bool AnalyzeUsesOfPointer(Value *V, std::vector<Function *> &Readers,
200 std::vector<Function *> &Writers,
201 GlobalValue *OkayStoreDest = nullptr);
202 bool AnalyzeIndirectGlobalMemory(GlobalValue *GV);
206 char GlobalsModRef::ID = 0;
207 INITIALIZE_AG_PASS_BEGIN(GlobalsModRef, AliasAnalysis, "globalsmodref-aa",
208 "Simple mod/ref analysis for globals", false, true,
210 INITIALIZE_PASS_DEPENDENCY(CallGraphWrapperPass)
211 INITIALIZE_AG_PASS_END(GlobalsModRef, AliasAnalysis, "globalsmodref-aa",
212 "Simple mod/ref analysis for globals", false, true,
215 Pass *llvm::createGlobalsModRefPass() { return new GlobalsModRef(); }
217 /// AnalyzeGlobals - Scan through the users of all of the internal
218 /// GlobalValue's in the program. If none of them have their "address taken"
219 /// (really, their address passed to something nontrivial), record this fact,
220 /// and record the functions that they are used directly in.
221 void GlobalsModRef::AnalyzeGlobals(Module &M) {
222 std::vector<Function *> Readers, Writers;
223 for (Function &F : M)
224 if (F.hasLocalLinkage()) {
225 if (!AnalyzeUsesOfPointer(&F, Readers, Writers)) {
226 // Remember that we are tracking this global.
227 NonAddressTakenGlobals.insert(&F);
228 ++NumNonAddrTakenFunctions;
234 for (GlobalVariable &GV : M.globals())
235 if (GV.hasLocalLinkage()) {
236 if (!AnalyzeUsesOfPointer(&GV, Readers, Writers)) {
237 // Remember that we are tracking this global, and the mod/ref fns
238 NonAddressTakenGlobals.insert(&GV);
240 for (Function *Reader : Readers)
241 FunctionInfo[Reader].GlobalInfo[&GV] |= Ref;
243 if (!GV.isConstant()) // No need to keep track of writers to constants
244 for (Function *Writer : Writers)
245 FunctionInfo[Writer].GlobalInfo[&GV] |= Mod;
246 ++NumNonAddrTakenGlobalVars;
248 // If this global holds a pointer type, see if it is an indirect global.
249 if (GV.getType()->getElementType()->isPointerTy() &&
250 AnalyzeIndirectGlobalMemory(&GV))
251 ++NumIndirectGlobalVars;
258 /// AnalyzeUsesOfPointer - Look at all of the users of the specified pointer.
259 /// If this is used by anything complex (i.e., the address escapes), return
260 /// true. Also, while we are at it, keep track of those functions that read and
261 /// write to the value.
263 /// If OkayStoreDest is non-null, stores into this global are allowed.
264 bool GlobalsModRef::AnalyzeUsesOfPointer(Value *V,
265 std::vector<Function *> &Readers,
266 std::vector<Function *> &Writers,
267 GlobalValue *OkayStoreDest) {
268 if (!V->getType()->isPointerTy())
271 for (Use &U : V->uses()) {
272 User *I = U.getUser();
273 if (LoadInst *LI = dyn_cast<LoadInst>(I)) {
274 Readers.push_back(LI->getParent()->getParent());
275 } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) {
276 if (V == SI->getOperand(1)) {
277 Writers.push_back(SI->getParent()->getParent());
278 } else if (SI->getOperand(1) != OkayStoreDest) {
279 return true; // Storing the pointer
281 } else if (Operator::getOpcode(I) == Instruction::GetElementPtr) {
282 if (AnalyzeUsesOfPointer(I, Readers, Writers))
284 } else if (Operator::getOpcode(I) == Instruction::BitCast) {
285 if (AnalyzeUsesOfPointer(I, Readers, Writers, OkayStoreDest))
287 } else if (auto CS = CallSite(I)) {
288 // Make sure that this is just the function being called, not that it is
289 // passing into the function.
290 if (!CS.isCallee(&U)) {
291 // Detect calls to free.
292 if (isFreeCall(I, TLI))
293 Writers.push_back(CS->getParent()->getParent());
295 return true; // Argument of an unknown call.
297 } else if (ICmpInst *ICI = dyn_cast<ICmpInst>(I)) {
298 if (!isa<ConstantPointerNull>(ICI->getOperand(1)))
299 return true; // Allow comparison against null.
308 /// AnalyzeIndirectGlobalMemory - We found an non-address-taken global variable
309 /// which holds a pointer type. See if the global always points to non-aliased
310 /// heap memory: that is, all initializers of the globals are allocations, and
311 /// those allocations have no use other than initialization of the global.
312 /// Further, all loads out of GV must directly use the memory, not store the
313 /// pointer somewhere. If this is true, we consider the memory pointed to by
314 /// GV to be owned by GV and can disambiguate other pointers from it.
315 bool GlobalsModRef::AnalyzeIndirectGlobalMemory(GlobalValue *GV) {
316 // Keep track of values related to the allocation of the memory, f.e. the
317 // value produced by the malloc call and any casts.
318 std::vector<Value *> AllocRelatedValues;
320 // Walk the user list of the global. If we find anything other than a direct
321 // load or store, bail out.
322 for (User *U : GV->users()) {
323 if (LoadInst *LI = dyn_cast<LoadInst>(U)) {
324 // The pointer loaded from the global can only be used in simple ways:
325 // we allow addressing of it and loading storing to it. We do *not* allow
326 // storing the loaded pointer somewhere else or passing to a function.
327 std::vector<Function *> ReadersWriters;
328 if (AnalyzeUsesOfPointer(LI, ReadersWriters, ReadersWriters))
329 return false; // Loaded pointer escapes.
330 // TODO: Could try some IP mod/ref of the loaded pointer.
331 } else if (StoreInst *SI = dyn_cast<StoreInst>(U)) {
332 // Storing the global itself.
333 if (SI->getOperand(0) == GV)
336 // If storing the null pointer, ignore it.
337 if (isa<ConstantPointerNull>(SI->getOperand(0)))
340 // Check the value being stored.
341 Value *Ptr = GetUnderlyingObject(SI->getOperand(0),
342 GV->getParent()->getDataLayout());
344 if (!isAllocLikeFn(Ptr, TLI))
345 return false; // Too hard to analyze.
347 // Analyze all uses of the allocation. If any of them are used in a
348 // non-simple way (e.g. stored to another global) bail out.
349 std::vector<Function *> ReadersWriters;
350 if (AnalyzeUsesOfPointer(Ptr, ReadersWriters, ReadersWriters, GV))
351 return false; // Loaded pointer escapes.
353 // Remember that this allocation is related to the indirect global.
354 AllocRelatedValues.push_back(Ptr);
356 // Something complex, bail out.
361 // Okay, this is an indirect global. Remember all of the allocations for
362 // this global in AllocsForIndirectGlobals.
363 while (!AllocRelatedValues.empty()) {
364 AllocsForIndirectGlobals[AllocRelatedValues.back()] = GV;
365 AllocRelatedValues.pop_back();
367 IndirectGlobals.insert(GV);
371 /// AnalyzeCallGraph - At this point, we know the functions where globals are
372 /// immediately stored to and read from. Propagate this information up the call
373 /// graph to all callers and compute the mod/ref info for all memory for each
375 void GlobalsModRef::AnalyzeCallGraph(CallGraph &CG, Module &M) {
376 // We do a bottom-up SCC traversal of the call graph. In other words, we
377 // visit all callees before callers (leaf-first).
378 for (scc_iterator<CallGraph *> I = scc_begin(&CG); !I.isAtEnd(); ++I) {
379 const std::vector<CallGraphNode *> &SCC = *I;
380 assert(!SCC.empty() && "SCC with no functions?");
382 if (!SCC[0]->getFunction()) {
383 // Calls externally - can't say anything useful. Remove any existing
384 // function records (may have been created when scanning globals).
385 for (auto *Node : SCC)
386 FunctionInfo.erase(Node->getFunction());
390 FunctionRecord &FR = FunctionInfo[SCC[0]->getFunction()];
392 bool KnowNothing = false;
393 unsigned FunctionEffect = 0;
395 // Collect the mod/ref properties due to called functions. We only compute
397 for (unsigned i = 0, e = SCC.size(); i != e && !KnowNothing; ++i) {
398 Function *F = SCC[i]->getFunction();
404 if (F->isDeclaration()) {
405 // Try to get mod/ref behaviour from function attributes.
406 if (F->doesNotAccessMemory()) {
407 // Can't do better than that!
408 } else if (F->onlyReadsMemory()) {
409 FunctionEffect |= Ref;
410 if (!F->isIntrinsic())
411 // This function might call back into the module and read a global -
412 // consider every global as possibly being read by this function.
413 FR.MayReadAnyGlobal = true;
415 FunctionEffect |= ModRef;
416 // Can't say anything useful unless it's an intrinsic - they don't
417 // read or write global variables of the kind considered here.
418 KnowNothing = !F->isIntrinsic();
423 for (CallGraphNode::iterator CI = SCC[i]->begin(), E = SCC[i]->end();
424 CI != E && !KnowNothing; ++CI)
425 if (Function *Callee = CI->second->getFunction()) {
426 if (FunctionRecord *CalleeFR = getFunctionInfo(Callee)) {
427 // Propagate function effect up.
428 FunctionEffect |= CalleeFR->FunctionEffect;
430 // Incorporate callee's effects on globals into our info.
431 for (const auto &G : CalleeFR->GlobalInfo)
432 FR.GlobalInfo[G.first] |= G.second;
433 FR.MayReadAnyGlobal |= CalleeFR->MayReadAnyGlobal;
435 // Can't say anything about it. However, if it is inside our SCC,
436 // then nothing needs to be done.
437 CallGraphNode *CalleeNode = CG[Callee];
438 if (std::find(SCC.begin(), SCC.end(), CalleeNode) == SCC.end())
446 // If we can't say anything useful about this SCC, remove all SCC functions
447 // from the FunctionInfo map.
449 for (auto *Node : SCC)
450 FunctionInfo.erase(Node->getFunction());
454 // Scan the function bodies for explicit loads or stores.
455 for (auto *Node : SCC) {
456 if (FunctionEffect == ModRef)
457 break; // The mod/ref lattice saturates here.
458 for (Instruction &I : inst_range(Node->getFunction())) {
459 if (FunctionEffect == ModRef)
460 break; // The mod/ref lattice saturates here.
462 // We handle calls specially because the graph-relevant aspects are
464 if (auto CS = CallSite(&I)) {
465 if (isAllocationFn(&I, TLI) || isFreeCall(&I, TLI)) {
466 // FIXME: It is completely unclear why this is necessary and not
467 // handled by the above graph code.
468 FunctionEffect |= ModRef;
469 } else if (Function *Callee = CS.getCalledFunction()) {
470 // The callgraph doesn't include intrinsic calls.
471 if (Callee->isIntrinsic()) {
472 ModRefBehavior Behaviour =
473 AliasAnalysis::getModRefBehavior(Callee);
474 FunctionEffect |= (Behaviour & ModRef);
480 // All non-call instructions we use the primary predicates for whether
481 // thay read or write memory.
482 if (I.mayReadFromMemory())
483 FunctionEffect |= Ref;
484 if (I.mayWriteToMemory())
485 FunctionEffect |= Mod;
489 if ((FunctionEffect & Mod) == 0)
490 ++NumReadMemFunctions;
491 if (FunctionEffect == 0)
493 FR.FunctionEffect = FunctionEffect;
495 // Finally, now that we know the full effect on this SCC, clone the
496 // information to each function in the SCC.
497 for (unsigned i = 1, e = SCC.size(); i != e; ++i)
498 FunctionInfo[SCC[i]->getFunction()] = FR;
502 /// alias - If one of the pointers is to a global that we are tracking, and the
503 /// other is some random pointer, we know there cannot be an alias, because the
504 /// address of the global isn't taken.
505 AliasResult GlobalsModRef::alias(const MemoryLocation &LocA,
506 const MemoryLocation &LocB) {
507 // Get the base object these pointers point to.
508 const Value *UV1 = GetUnderlyingObject(LocA.Ptr, *DL);
509 const Value *UV2 = GetUnderlyingObject(LocB.Ptr, *DL);
511 // If either of the underlying values is a global, they may be non-addr-taken
512 // globals, which we can answer queries about.
513 const GlobalValue *GV1 = dyn_cast<GlobalValue>(UV1);
514 const GlobalValue *GV2 = dyn_cast<GlobalValue>(UV2);
516 // If the global's address is taken, pretend we don't know it's a pointer to
518 if (GV1 && !NonAddressTakenGlobals.count(GV1))
520 if (GV2 && !NonAddressTakenGlobals.count(GV2))
523 // If the two pointers are derived from two different non-addr-taken
524 // globals we know these can't alias.
525 if (GV1 && GV2 && GV1 != GV2)
528 // If one is and the other isn't, it isn't strictly safe but we can fake
529 // this result if necessary for performance. This does not appear to be
530 // a common problem in practice.
531 if (EnableUnsafeGlobalsModRefAliasResults)
532 if ((GV1 || GV2) && GV1 != GV2)
535 // Otherwise if they are both derived from the same addr-taken global, we
536 // can't know the two accesses don't overlap.
539 // These pointers may be based on the memory owned by an indirect global. If
540 // so, we may be able to handle this. First check to see if the base pointer
541 // is a direct load from an indirect global.
543 if (const LoadInst *LI = dyn_cast<LoadInst>(UV1))
544 if (GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0)))
545 if (IndirectGlobals.count(GV))
547 if (const LoadInst *LI = dyn_cast<LoadInst>(UV2))
548 if (const GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0)))
549 if (IndirectGlobals.count(GV))
552 // These pointers may also be from an allocation for the indirect global. If
553 // so, also handle them.
554 if (AllocsForIndirectGlobals.count(UV1))
555 GV1 = AllocsForIndirectGlobals[UV1];
556 if (AllocsForIndirectGlobals.count(UV2))
557 GV2 = AllocsForIndirectGlobals[UV2];
559 // Now that we know whether the two pointers are related to indirect globals,
560 // use this to disambiguate the pointers. If the pointers are based on
561 // different indirect globals they cannot alias.
562 if (GV1 && GV2 && GV1 != GV2)
565 // If one is based on an indirect global and the other isn't, it isn't
566 // strictly safe but we can fake this result if necessary for performance.
567 // This does not appear to be a common problem in practice.
568 if (EnableUnsafeGlobalsModRefAliasResults)
569 if ((GV1 || GV2) && GV1 != GV2)
572 return AliasAnalysis::alias(LocA, LocB);
575 AliasAnalysis::ModRefResult
576 GlobalsModRef::getModRefInfo(ImmutableCallSite CS, const MemoryLocation &Loc) {
577 unsigned Known = ModRef;
579 // If we are asking for mod/ref info of a direct call with a pointer to a
580 // global we are tracking, return information if we have it.
581 const DataLayout &DL = CS.getCaller()->getParent()->getDataLayout();
582 if (const GlobalValue *GV =
583 dyn_cast<GlobalValue>(GetUnderlyingObject(Loc.Ptr, DL)))
584 if (GV->hasLocalLinkage())
585 if (const Function *F = CS.getCalledFunction())
586 if (NonAddressTakenGlobals.count(GV))
587 if (const FunctionRecord *FR = getFunctionInfo(F))
588 Known = FR->getInfoForGlobal(GV);
590 if (Known == NoModRef)
591 return NoModRef; // No need to query other mod/ref analyses
592 return ModRefResult(Known & AliasAnalysis::getModRefInfo(CS, Loc));
595 //===----------------------------------------------------------------------===//
596 // Methods to update the analysis as a result of the client transformation.
598 void GlobalsModRef::deleteValue(Value *V) {
599 if (GlobalValue *GV = dyn_cast<GlobalValue>(V)) {
600 if (NonAddressTakenGlobals.erase(GV)) {
601 // This global might be an indirect global. If so, remove it and remove
602 // any AllocRelatedValues for it.
603 if (IndirectGlobals.erase(GV)) {
604 // Remove any entries in AllocsForIndirectGlobals for this global.
605 for (std::map<const Value *, const GlobalValue *>::iterator
606 I = AllocsForIndirectGlobals.begin(),
607 E = AllocsForIndirectGlobals.end();
609 if (I->second == GV) {
610 AllocsForIndirectGlobals.erase(I++);
619 // Otherwise, if this is an allocation related to an indirect global, remove
621 AllocsForIndirectGlobals.erase(V);
623 AliasAnalysis::deleteValue(V);