1 //===- GlobalsModRef.cpp - Simple Mod/Ref Analysis for Globals ------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This simple pass provides alias and mod/ref information for global values
11 // that do not have their address taken, and keeps track of whether functions
12 // read or write memory (are "pure"). For this simple (but very common) case,
13 // we can provide pretty accurate and useful information.
15 //===----------------------------------------------------------------------===//
17 #include "llvm/Analysis/Passes.h"
18 #include "llvm/ADT/SCCIterator.h"
19 #include "llvm/ADT/Statistic.h"
20 #include "llvm/Analysis/AliasAnalysis.h"
21 #include "llvm/Analysis/CallGraph.h"
22 #include "llvm/Analysis/MemoryBuiltins.h"
23 #include "llvm/Analysis/ValueTracking.h"
24 #include "llvm/IR/Constants.h"
25 #include "llvm/IR/DerivedTypes.h"
26 #include "llvm/IR/InstIterator.h"
27 #include "llvm/IR/Instructions.h"
28 #include "llvm/IR/IntrinsicInst.h"
29 #include "llvm/IR/Module.h"
30 #include "llvm/Pass.h"
31 #include "llvm/Support/CommandLine.h"
35 #define DEBUG_TYPE "globalsmodref-aa"
37 STATISTIC(NumNonAddrTakenGlobalVars,
38 "Number of global vars without address taken");
39 STATISTIC(NumNonAddrTakenFunctions,"Number of functions without address taken");
40 STATISTIC(NumNoMemFunctions, "Number of functions that do not access memory");
41 STATISTIC(NumReadMemFunctions, "Number of functions that only read memory");
42 STATISTIC(NumIndirectGlobalVars, "Number of indirect global objects");
45 /// FunctionRecord - One instance of this structure is stored for every
46 /// function in the program. Later, the entries for these functions are
47 /// removed if the function is found to call an external function (in which
48 /// case we know nothing about it.
49 struct FunctionRecord {
50 /// GlobalInfo - Maintain mod/ref info for all of the globals without
51 /// addresses taken that are read or written (transitively) by this
53 std::map<const GlobalValue *, unsigned> GlobalInfo;
55 /// MayReadAnyGlobal - May read global variables, but it is not known which.
56 bool MayReadAnyGlobal;
58 unsigned getInfoForGlobal(const GlobalValue *GV) const {
59 unsigned Effect = MayReadAnyGlobal ? AliasAnalysis::Ref : 0;
60 std::map<const GlobalValue *, unsigned>::const_iterator I =
62 if (I != GlobalInfo.end())
67 /// FunctionEffect - Capture whether or not this function reads or writes to
68 /// ANY memory. If not, we can do a lot of aggressive analysis on it.
69 unsigned FunctionEffect;
71 FunctionRecord() : MayReadAnyGlobal(false), FunctionEffect(0) {}
74 /// GlobalsModRef - The actual analysis pass.
75 class GlobalsModRef : public ModulePass, public AliasAnalysis {
76 /// NonAddressTakenGlobals - The globals that do not have their addresses
78 std::set<const GlobalValue *> NonAddressTakenGlobals;
80 /// IndirectGlobals - The memory pointed to by this global is known to be
81 /// 'owned' by the global.
82 std::set<const GlobalValue *> IndirectGlobals;
84 /// AllocsForIndirectGlobals - If an instruction allocates memory for an
85 /// indirect global, this map indicates which one.
86 std::map<const Value *, const GlobalValue *> AllocsForIndirectGlobals;
88 /// FunctionInfo - For each function, keep track of what globals are
90 std::map<const Function *, FunctionRecord> FunctionInfo;
94 GlobalsModRef() : ModulePass(ID) {
95 initializeGlobalsModRefPass(*PassRegistry::getPassRegistry());
98 bool runOnModule(Module &M) override {
99 InitializeAliasAnalysis(this, &M.getDataLayout());
101 // Find non-addr taken globals.
105 AnalyzeCallGraph(getAnalysis<CallGraphWrapperPass>().getCallGraph(), M);
109 void getAnalysisUsage(AnalysisUsage &AU) const override {
110 AliasAnalysis::getAnalysisUsage(AU);
111 AU.addRequired<CallGraphWrapperPass>();
112 AU.setPreservesAll(); // Does not transform code
115 //------------------------------------------------
116 // Implement the AliasAnalysis API
118 AliasResult alias(const MemoryLocation &LocA,
119 const MemoryLocation &LocB) override;
120 ModRefResult getModRefInfo(ImmutableCallSite CS,
121 const MemoryLocation &Loc) override;
122 ModRefResult getModRefInfo(ImmutableCallSite CS1,
123 ImmutableCallSite CS2) override {
124 return AliasAnalysis::getModRefInfo(CS1, CS2);
127 /// getModRefBehavior - Return the behavior of the specified function if
128 /// called from the specified call site. The call site may be null in which
129 /// case the most generic behavior of this function should be returned.
130 ModRefBehavior getModRefBehavior(const Function *F) override {
131 ModRefBehavior Min = UnknownModRefBehavior;
133 if (FunctionRecord *FR = getFunctionInfo(F)) {
134 if (FR->FunctionEffect == 0)
135 Min = DoesNotAccessMemory;
136 else if ((FR->FunctionEffect & Mod) == 0)
137 Min = OnlyReadsMemory;
140 return ModRefBehavior(AliasAnalysis::getModRefBehavior(F) & Min);
143 /// getModRefBehavior - Return the behavior of the specified function if
144 /// called from the specified call site. The call site may be null in which
145 /// case the most generic behavior of this function should be returned.
146 ModRefBehavior getModRefBehavior(ImmutableCallSite CS) override {
147 ModRefBehavior Min = UnknownModRefBehavior;
149 if (const Function *F = CS.getCalledFunction())
150 if (FunctionRecord *FR = getFunctionInfo(F)) {
151 if (FR->FunctionEffect == 0)
152 Min = DoesNotAccessMemory;
153 else if ((FR->FunctionEffect & Mod) == 0)
154 Min = OnlyReadsMemory;
157 return ModRefBehavior(AliasAnalysis::getModRefBehavior(CS) & Min);
160 void deleteValue(Value *V) override;
161 void addEscapingUse(Use &U) override;
163 /// getAdjustedAnalysisPointer - This method is used when a pass implements
164 /// an analysis interface through multiple inheritance. If needed, it
165 /// should override this to adjust the this pointer as needed for the
166 /// specified pass info.
167 void *getAdjustedAnalysisPointer(AnalysisID PI) override {
168 if (PI == &AliasAnalysis::ID)
169 return (AliasAnalysis *)this;
174 /// getFunctionInfo - Return the function info for the function, or null if
175 /// we don't have anything useful to say about it.
176 FunctionRecord *getFunctionInfo(const Function *F) {
177 std::map<const Function *, FunctionRecord>::iterator I =
178 FunctionInfo.find(F);
179 if (I != FunctionInfo.end())
184 void AnalyzeGlobals(Module &M);
185 void AnalyzeCallGraph(CallGraph &CG, Module &M);
186 bool AnalyzeUsesOfPointer(Value *V, std::vector<Function *> &Readers,
187 std::vector<Function *> &Writers,
188 GlobalValue *OkayStoreDest = nullptr);
189 bool AnalyzeIndirectGlobalMemory(GlobalValue *GV);
193 char GlobalsModRef::ID = 0;
194 INITIALIZE_AG_PASS_BEGIN(GlobalsModRef, AliasAnalysis, "globalsmodref-aa",
195 "Simple mod/ref analysis for globals", false, true,
197 INITIALIZE_PASS_DEPENDENCY(CallGraphWrapperPass)
198 INITIALIZE_AG_PASS_END(GlobalsModRef, AliasAnalysis, "globalsmodref-aa",
199 "Simple mod/ref analysis for globals", false, true,
202 Pass *llvm::createGlobalsModRefPass() { return new GlobalsModRef(); }
204 /// AnalyzeGlobals - Scan through the users of all of the internal
205 /// GlobalValue's in the program. If none of them have their "address taken"
206 /// (really, their address passed to something nontrivial), record this fact,
207 /// and record the functions that they are used directly in.
208 void GlobalsModRef::AnalyzeGlobals(Module &M) {
209 std::vector<Function *> Readers, Writers;
210 for (Module::iterator I = M.begin(), E = M.end(); I != E; ++I)
211 if (I->hasLocalLinkage()) {
212 if (!AnalyzeUsesOfPointer(I, Readers, Writers)) {
213 // Remember that we are tracking this global.
214 NonAddressTakenGlobals.insert(I);
215 ++NumNonAddrTakenFunctions;
221 for (Module::global_iterator I = M.global_begin(), E = M.global_end(); I != E;
223 if (I->hasLocalLinkage()) {
224 if (!AnalyzeUsesOfPointer(I, Readers, Writers)) {
225 // Remember that we are tracking this global, and the mod/ref fns
226 NonAddressTakenGlobals.insert(I);
228 for (unsigned i = 0, e = Readers.size(); i != e; ++i)
229 FunctionInfo[Readers[i]].GlobalInfo[I] |= Ref;
231 if (!I->isConstant()) // No need to keep track of writers to constants
232 for (unsigned i = 0, e = Writers.size(); i != e; ++i)
233 FunctionInfo[Writers[i]].GlobalInfo[I] |= Mod;
234 ++NumNonAddrTakenGlobalVars;
236 // If this global holds a pointer type, see if it is an indirect global.
237 if (I->getType()->getElementType()->isPointerTy() &&
238 AnalyzeIndirectGlobalMemory(I))
239 ++NumIndirectGlobalVars;
246 /// AnalyzeUsesOfPointer - Look at all of the users of the specified pointer.
247 /// If this is used by anything complex (i.e., the address escapes), return
248 /// true. Also, while we are at it, keep track of those functions that read and
249 /// write to the value.
251 /// If OkayStoreDest is non-null, stores into this global are allowed.
252 bool GlobalsModRef::AnalyzeUsesOfPointer(Value *V,
253 std::vector<Function *> &Readers,
254 std::vector<Function *> &Writers,
255 GlobalValue *OkayStoreDest) {
256 if (!V->getType()->isPointerTy())
259 for (Use &U : V->uses()) {
260 User *I = U.getUser();
261 if (LoadInst *LI = dyn_cast<LoadInst>(I)) {
262 Readers.push_back(LI->getParent()->getParent());
263 } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) {
264 if (V == SI->getOperand(1)) {
265 Writers.push_back(SI->getParent()->getParent());
266 } else if (SI->getOperand(1) != OkayStoreDest) {
267 return true; // Storing the pointer
269 } else if (Operator::getOpcode(I) == Instruction::GetElementPtr) {
270 if (AnalyzeUsesOfPointer(I, Readers, Writers))
272 } else if (Operator::getOpcode(I) == Instruction::BitCast) {
273 if (AnalyzeUsesOfPointer(I, Readers, Writers, OkayStoreDest))
275 } else if (auto CS = CallSite(I)) {
276 // Make sure that this is just the function being called, not that it is
277 // passing into the function.
278 if (!CS.isCallee(&U)) {
279 // Detect calls to free.
280 if (isFreeCall(I, TLI))
281 Writers.push_back(CS->getParent()->getParent());
283 return true; // Argument of an unknown call.
285 } else if (ICmpInst *ICI = dyn_cast<ICmpInst>(I)) {
286 if (!isa<ConstantPointerNull>(ICI->getOperand(1)))
287 return true; // Allow comparison against null.
296 /// AnalyzeIndirectGlobalMemory - We found an non-address-taken global variable
297 /// which holds a pointer type. See if the global always points to non-aliased
298 /// heap memory: that is, all initializers of the globals are allocations, and
299 /// those allocations have no use other than initialization of the global.
300 /// Further, all loads out of GV must directly use the memory, not store the
301 /// pointer somewhere. If this is true, we consider the memory pointed to by
302 /// GV to be owned by GV and can disambiguate other pointers from it.
303 bool GlobalsModRef::AnalyzeIndirectGlobalMemory(GlobalValue *GV) {
304 // Keep track of values related to the allocation of the memory, f.e. the
305 // value produced by the malloc call and any casts.
306 std::vector<Value *> AllocRelatedValues;
308 // Walk the user list of the global. If we find anything other than a direct
309 // load or store, bail out.
310 for (User *U : GV->users()) {
311 if (LoadInst *LI = dyn_cast<LoadInst>(U)) {
312 // The pointer loaded from the global can only be used in simple ways:
313 // we allow addressing of it and loading storing to it. We do *not* allow
314 // storing the loaded pointer somewhere else or passing to a function.
315 std::vector<Function *> ReadersWriters;
316 if (AnalyzeUsesOfPointer(LI, ReadersWriters, ReadersWriters))
317 return false; // Loaded pointer escapes.
318 // TODO: Could try some IP mod/ref of the loaded pointer.
319 } else if (StoreInst *SI = dyn_cast<StoreInst>(U)) {
320 // Storing the global itself.
321 if (SI->getOperand(0) == GV)
324 // If storing the null pointer, ignore it.
325 if (isa<ConstantPointerNull>(SI->getOperand(0)))
328 // Check the value being stored.
329 Value *Ptr = GetUnderlyingObject(SI->getOperand(0),
330 GV->getParent()->getDataLayout());
332 if (!isAllocLikeFn(Ptr, TLI))
333 return false; // Too hard to analyze.
335 // Analyze all uses of the allocation. If any of them are used in a
336 // non-simple way (e.g. stored to another global) bail out.
337 std::vector<Function *> ReadersWriters;
338 if (AnalyzeUsesOfPointer(Ptr, ReadersWriters, ReadersWriters, GV))
339 return false; // Loaded pointer escapes.
341 // Remember that this allocation is related to the indirect global.
342 AllocRelatedValues.push_back(Ptr);
344 // Something complex, bail out.
349 // Okay, this is an indirect global. Remember all of the allocations for
350 // this global in AllocsForIndirectGlobals.
351 while (!AllocRelatedValues.empty()) {
352 AllocsForIndirectGlobals[AllocRelatedValues.back()] = GV;
353 AllocRelatedValues.pop_back();
355 IndirectGlobals.insert(GV);
359 /// AnalyzeCallGraph - At this point, we know the functions where globals are
360 /// immediately stored to and read from. Propagate this information up the call
361 /// graph to all callers and compute the mod/ref info for all memory for each
363 void GlobalsModRef::AnalyzeCallGraph(CallGraph &CG, Module &M) {
364 // We do a bottom-up SCC traversal of the call graph. In other words, we
365 // visit all callees before callers (leaf-first).
366 for (scc_iterator<CallGraph *> I = scc_begin(&CG); !I.isAtEnd(); ++I) {
367 const std::vector<CallGraphNode *> &SCC = *I;
368 assert(!SCC.empty() && "SCC with no functions?");
370 if (!SCC[0]->getFunction()) {
371 // Calls externally - can't say anything useful. Remove any existing
372 // function records (may have been created when scanning globals).
373 for (unsigned i = 0, e = SCC.size(); i != e; ++i)
374 FunctionInfo.erase(SCC[i]->getFunction());
378 FunctionRecord &FR = FunctionInfo[SCC[0]->getFunction()];
380 bool KnowNothing = false;
381 unsigned FunctionEffect = 0;
383 // Collect the mod/ref properties due to called functions. We only compute
385 for (unsigned i = 0, e = SCC.size(); i != e && !KnowNothing; ++i) {
386 Function *F = SCC[i]->getFunction();
392 if (F->isDeclaration()) {
393 // Try to get mod/ref behaviour from function attributes.
394 if (F->doesNotAccessMemory()) {
395 // Can't do better than that!
396 } else if (F->onlyReadsMemory()) {
397 FunctionEffect |= Ref;
398 if (!F->isIntrinsic())
399 // This function might call back into the module and read a global -
400 // consider every global as possibly being read by this function.
401 FR.MayReadAnyGlobal = true;
403 FunctionEffect |= ModRef;
404 // Can't say anything useful unless it's an intrinsic - they don't
405 // read or write global variables of the kind considered here.
406 KnowNothing = !F->isIntrinsic();
411 for (CallGraphNode::iterator CI = SCC[i]->begin(), E = SCC[i]->end();
412 CI != E && !KnowNothing; ++CI)
413 if (Function *Callee = CI->second->getFunction()) {
414 if (FunctionRecord *CalleeFR = getFunctionInfo(Callee)) {
415 // Propagate function effect up.
416 FunctionEffect |= CalleeFR->FunctionEffect;
418 // Incorporate callee's effects on globals into our info.
419 for (const auto &G : CalleeFR->GlobalInfo)
420 FR.GlobalInfo[G.first] |= G.second;
421 FR.MayReadAnyGlobal |= CalleeFR->MayReadAnyGlobal;
423 // Can't say anything about it. However, if it is inside our SCC,
424 // then nothing needs to be done.
425 CallGraphNode *CalleeNode = CG[Callee];
426 if (std::find(SCC.begin(), SCC.end(), CalleeNode) == SCC.end())
434 // If we can't say anything useful about this SCC, remove all SCC functions
435 // from the FunctionInfo map.
437 for (unsigned i = 0, e = SCC.size(); i != e; ++i)
438 FunctionInfo.erase(SCC[i]->getFunction());
442 // Scan the function bodies for explicit loads or stores.
443 for (unsigned i = 0, e = SCC.size(); i != e && FunctionEffect != ModRef;
445 for (inst_iterator II = inst_begin(SCC[i]->getFunction()),
446 E = inst_end(SCC[i]->getFunction());
447 II != E && FunctionEffect != ModRef; ++II)
448 if (LoadInst *LI = dyn_cast<LoadInst>(&*II)) {
449 FunctionEffect |= Ref;
450 if (LI->isVolatile())
451 // Volatile loads may have side-effects, so mark them as writing
452 // memory (for example, a flag inside the processor).
453 FunctionEffect |= Mod;
454 } else if (StoreInst *SI = dyn_cast<StoreInst>(&*II)) {
455 FunctionEffect |= Mod;
456 if (SI->isVolatile())
457 // Treat volatile stores as reading memory somewhere.
458 FunctionEffect |= Ref;
459 } else if (isAllocationFn(&*II, TLI) || isFreeCall(&*II, TLI)) {
460 FunctionEffect |= ModRef;
461 } else if (IntrinsicInst *Intrinsic = dyn_cast<IntrinsicInst>(&*II)) {
462 // The callgraph doesn't include intrinsic calls.
463 Function *Callee = Intrinsic->getCalledFunction();
464 ModRefBehavior Behaviour = AliasAnalysis::getModRefBehavior(Callee);
465 FunctionEffect |= (Behaviour & ModRef);
468 if ((FunctionEffect & Mod) == 0)
469 ++NumReadMemFunctions;
470 if (FunctionEffect == 0)
472 FR.FunctionEffect = FunctionEffect;
474 // Finally, now that we know the full effect on this SCC, clone the
475 // information to each function in the SCC.
476 for (unsigned i = 1, e = SCC.size(); i != e; ++i)
477 FunctionInfo[SCC[i]->getFunction()] = FR;
481 /// alias - If one of the pointers is to a global that we are tracking, and the
482 /// other is some random pointer, we know there cannot be an alias, because the
483 /// address of the global isn't taken.
484 AliasResult GlobalsModRef::alias(const MemoryLocation &LocA,
485 const MemoryLocation &LocB) {
486 // Get the base object these pointers point to.
487 const Value *UV1 = GetUnderlyingObject(LocA.Ptr, *DL);
488 const Value *UV2 = GetUnderlyingObject(LocB.Ptr, *DL);
490 // If either of the underlying values is a global, they may be non-addr-taken
491 // globals, which we can answer queries about.
492 const GlobalValue *GV1 = dyn_cast<GlobalValue>(UV1);
493 const GlobalValue *GV2 = dyn_cast<GlobalValue>(UV2);
495 // If the global's address is taken, pretend we don't know it's a pointer to
497 if (GV1 && !NonAddressTakenGlobals.count(GV1))
499 if (GV2 && !NonAddressTakenGlobals.count(GV2))
502 // If the two pointers are derived from two different non-addr-taken
503 // globals, or if one is and the other isn't, we know these can't alias.
504 if ((GV1 || GV2) && GV1 != GV2)
507 // Otherwise if they are both derived from the same addr-taken global, we
508 // can't know the two accesses don't overlap.
511 // These pointers may be based on the memory owned by an indirect global. If
512 // so, we may be able to handle this. First check to see if the base pointer
513 // is a direct load from an indirect global.
515 if (const LoadInst *LI = dyn_cast<LoadInst>(UV1))
516 if (GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0)))
517 if (IndirectGlobals.count(GV))
519 if (const LoadInst *LI = dyn_cast<LoadInst>(UV2))
520 if (const GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0)))
521 if (IndirectGlobals.count(GV))
524 // These pointers may also be from an allocation for the indirect global. If
525 // so, also handle them.
526 if (AllocsForIndirectGlobals.count(UV1))
527 GV1 = AllocsForIndirectGlobals[UV1];
528 if (AllocsForIndirectGlobals.count(UV2))
529 GV2 = AllocsForIndirectGlobals[UV2];
531 // Now that we know whether the two pointers are related to indirect globals,
532 // use this to disambiguate the pointers. If either pointer is based on an
533 // indirect global and if they are not both based on the same indirect global,
534 // they cannot alias.
535 if ((GV1 || GV2) && GV1 != GV2)
538 return AliasAnalysis::alias(LocA, LocB);
541 AliasAnalysis::ModRefResult
542 GlobalsModRef::getModRefInfo(ImmutableCallSite CS, const MemoryLocation &Loc) {
543 unsigned Known = ModRef;
545 // If we are asking for mod/ref info of a direct call with a pointer to a
546 // global we are tracking, return information if we have it.
547 const DataLayout &DL = CS.getCaller()->getParent()->getDataLayout();
548 if (const GlobalValue *GV =
549 dyn_cast<GlobalValue>(GetUnderlyingObject(Loc.Ptr, DL)))
550 if (GV->hasLocalLinkage())
551 if (const Function *F = CS.getCalledFunction())
552 if (NonAddressTakenGlobals.count(GV))
553 if (const FunctionRecord *FR = getFunctionInfo(F))
554 Known = FR->getInfoForGlobal(GV);
556 if (Known == NoModRef)
557 return NoModRef; // No need to query other mod/ref analyses
558 return ModRefResult(Known & AliasAnalysis::getModRefInfo(CS, Loc));
561 //===----------------------------------------------------------------------===//
562 // Methods to update the analysis as a result of the client transformation.
564 void GlobalsModRef::deleteValue(Value *V) {
565 if (GlobalValue *GV = dyn_cast<GlobalValue>(V)) {
566 if (NonAddressTakenGlobals.erase(GV)) {
567 // This global might be an indirect global. If so, remove it and remove
568 // any AllocRelatedValues for it.
569 if (IndirectGlobals.erase(GV)) {
570 // Remove any entries in AllocsForIndirectGlobals for this global.
571 for (std::map<const Value *, const GlobalValue *>::iterator
572 I = AllocsForIndirectGlobals.begin(),
573 E = AllocsForIndirectGlobals.end();
575 if (I->second == GV) {
576 AllocsForIndirectGlobals.erase(I++);
585 // Otherwise, if this is an allocation related to an indirect global, remove
587 AllocsForIndirectGlobals.erase(V);
589 AliasAnalysis::deleteValue(V);
592 void GlobalsModRef::addEscapingUse(Use &U) {
593 // For the purposes of this analysis, it is conservatively correct to treat
594 // a newly escaping value equivalently to a deleted one. We could perhaps
595 // be more precise by processing the new use and attempting to update our
596 // saved analysis results to accommodate it.
599 AliasAnalysis::addEscapingUse(U);