1 //===-- CodeGenTBAA.cpp - TBAA information for LLVM CodeGen ---------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This is the code that manages TBAA information and defines the TBAA policy 10 // for the optimizer to use. Relevant standards text includes: 11 // 12 // C99 6.5p7 13 // C++ [basic.lval] (p10 in n3126, p15 in some earlier versions) 14 // 15 //===----------------------------------------------------------------------===// 16 17 #include "CodeGenTBAA.h" 18 #include "clang/AST/ASTContext.h" 19 #include "clang/AST/Attr.h" 20 #include "clang/AST/Mangle.h" 21 #include "clang/AST/RecordLayout.h" 22 #include "clang/Basic/CodeGenOptions.h" 23 #include "llvm/ADT/SmallSet.h" 24 #include "llvm/IR/Constants.h" 25 #include "llvm/IR/LLVMContext.h" 26 #include "llvm/IR/Metadata.h" 27 #include "llvm/IR/Module.h" 28 #include "llvm/IR/Type.h" 29 using namespace clang; 30 using namespace CodeGen; 31 32 CodeGenTBAA::CodeGenTBAA(ASTContext &Ctx, llvm::Module &M, 33 const CodeGenOptions &CGO, 34 const LangOptions &Features, MangleContext &MContext) 35 : Context(Ctx), Module(M), CodeGenOpts(CGO), 36 Features(Features), MContext(MContext), MDHelper(M.getContext()), 37 Root(nullptr), Char(nullptr) 38 {} 39 40 CodeGenTBAA::~CodeGenTBAA() { 41 } 42 43 llvm::MDNode *CodeGenTBAA::getRoot() { 44 // Define the root of the tree. This identifies the tree, so that 45 // if our LLVM IR is linked with LLVM IR from a different front-end 46 // (or a different version of this front-end), their TBAA trees will 47 // remain distinct, and the optimizer will treat them conservatively. 48 if (!Root) { 49 if (Features.CPlusPlus) 50 Root = MDHelper.createTBAARoot("Simple C++ TBAA"); 51 else 52 Root = MDHelper.createTBAARoot("Simple C/C++ TBAA"); 53 } 54 55 return Root; 56 } 57 58 llvm::MDNode *CodeGenTBAA::createScalarTypeNode(StringRef Name, 59 llvm::MDNode *Parent, 60 uint64_t Size) { 61 if (CodeGenOpts.NewStructPathTBAA) { 62 llvm::Metadata *Id = MDHelper.createString(Name); 63 return MDHelper.createTBAATypeNode(Parent, Size, Id); 64 } 65 return MDHelper.createTBAAScalarTypeNode(Name, Parent); 66 } 67 68 llvm::MDNode *CodeGenTBAA::getChar() { 69 // Define the root of the tree for user-accessible memory. C and C++ 70 // give special powers to char and certain similar types. However, 71 // these special powers only cover user-accessible memory, and doesn't 72 // include things like vtables. 73 if (!Char) 74 Char = createScalarTypeNode("omnipotent char", getRoot(), /* Size= */ 1); 75 76 return Char; 77 } 78 79 static bool TypeHasMayAlias(QualType QTy) { 80 // Tagged types have declarations, and therefore may have attributes. 81 if (auto *TD = QTy->getAsTagDecl()) 82 if (TD->hasAttr<MayAliasAttr>()) 83 return true; 84 85 // Also look for may_alias as a declaration attribute on a typedef. 86 // FIXME: We should follow GCC and model may_alias as a type attribute 87 // rather than as a declaration attribute. 88 while (auto *TT = QTy->getAs<TypedefType>()) { 89 if (TT->getDecl()->hasAttr<MayAliasAttr>()) 90 return true; 91 QTy = TT->desugar(); 92 } 93 return false; 94 } 95 96 /// Check if the given type is a valid base type to be used in access tags. 97 static bool isValidBaseType(QualType QTy) { 98 if (QTy->isReferenceType()) 99 return false; 100 if (const RecordType *TTy = QTy->getAs<RecordType>()) { 101 const RecordDecl *RD = TTy->getDecl()->getDefinition(); 102 // Incomplete types are not valid base access types. 103 if (!RD) 104 return false; 105 if (RD->hasFlexibleArrayMember()) 106 return false; 107 // RD can be struct, union, class, interface or enum. 108 // For now, we only handle struct and class. 109 if (RD->isStruct() || RD->isClass()) 110 return true; 111 } 112 return false; 113 } 114 115 llvm::MDNode *CodeGenTBAA::getTypeInfoHelper(const Type *Ty) { 116 uint64_t Size = Context.getTypeSizeInChars(Ty).getQuantity(); 117 118 // Handle builtin types. 119 if (const BuiltinType *BTy = dyn_cast<BuiltinType>(Ty)) { 120 switch (BTy->getKind()) { 121 // Character types are special and can alias anything. 122 // In C++, this technically only includes "char" and "unsigned char", 123 // and not "signed char". In C, it includes all three. For now, 124 // the risk of exploiting this detail in C++ seems likely to outweigh 125 // the benefit. 126 case BuiltinType::Char_U: 127 case BuiltinType::Char_S: 128 case BuiltinType::UChar: 129 case BuiltinType::SChar: 130 return getChar(); 131 132 // Unsigned types can alias their corresponding signed types. 133 case BuiltinType::UShort: 134 return getTypeInfo(Context.ShortTy); 135 case BuiltinType::UInt: 136 return getTypeInfo(Context.IntTy); 137 case BuiltinType::ULong: 138 return getTypeInfo(Context.LongTy); 139 case BuiltinType::ULongLong: 140 return getTypeInfo(Context.LongLongTy); 141 case BuiltinType::UInt128: 142 return getTypeInfo(Context.Int128Ty); 143 144 case BuiltinType::UShortFract: 145 return getTypeInfo(Context.ShortFractTy); 146 case BuiltinType::UFract: 147 return getTypeInfo(Context.FractTy); 148 case BuiltinType::ULongFract: 149 return getTypeInfo(Context.LongFractTy); 150 151 case BuiltinType::SatUShortFract: 152 return getTypeInfo(Context.SatShortFractTy); 153 case BuiltinType::SatUFract: 154 return getTypeInfo(Context.SatFractTy); 155 case BuiltinType::SatULongFract: 156 return getTypeInfo(Context.SatLongFractTy); 157 158 case BuiltinType::UShortAccum: 159 return getTypeInfo(Context.ShortAccumTy); 160 case BuiltinType::UAccum: 161 return getTypeInfo(Context.AccumTy); 162 case BuiltinType::ULongAccum: 163 return getTypeInfo(Context.LongAccumTy); 164 165 case BuiltinType::SatUShortAccum: 166 return getTypeInfo(Context.SatShortAccumTy); 167 case BuiltinType::SatUAccum: 168 return getTypeInfo(Context.SatAccumTy); 169 case BuiltinType::SatULongAccum: 170 return getTypeInfo(Context.SatLongAccumTy); 171 172 // Treat all other builtin types as distinct types. This includes 173 // treating wchar_t, char16_t, and char32_t as distinct from their 174 // "underlying types". 175 default: 176 return createScalarTypeNode(BTy->getName(Features), getChar(), Size); 177 } 178 } 179 180 // C++1z [basic.lval]p10: "If a program attempts to access the stored value of 181 // an object through a glvalue of other than one of the following types the 182 // behavior is undefined: [...] a char, unsigned char, or std::byte type." 183 if (Ty->isStdByteType()) 184 return getChar(); 185 186 // Handle pointers and references. 187 // TODO: Implement C++'s type "similarity" and consider dis-"similar" 188 // pointers distinct. 189 if (Ty->isPointerType() || Ty->isReferenceType()) 190 return createScalarTypeNode("any pointer", getChar(), Size); 191 192 // Accesses to arrays are accesses to objects of their element types. 193 if (CodeGenOpts.NewStructPathTBAA && Ty->isArrayType()) 194 return getTypeInfo(cast<ArrayType>(Ty)->getElementType()); 195 196 // Enum types are distinct types. In C++ they have "underlying types", 197 // however they aren't related for TBAA. 198 if (const EnumType *ETy = dyn_cast<EnumType>(Ty)) { 199 if (!Features.CPlusPlus) 200 return getTypeInfo(ETy->getDecl()->getIntegerType()); 201 202 // In C++ mode, types have linkage, so we can rely on the ODR and 203 // on their mangled names, if they're external. 204 // TODO: Is there a way to get a program-wide unique name for a 205 // decl with local linkage or no linkage? 206 if (!ETy->getDecl()->isExternallyVisible()) 207 return getChar(); 208 209 SmallString<256> OutName; 210 llvm::raw_svector_ostream Out(OutName); 211 MContext.mangleCanonicalTypeName(QualType(ETy, 0), Out); 212 return createScalarTypeNode(OutName, getChar(), Size); 213 } 214 215 if (const auto *EIT = dyn_cast<BitIntType>(Ty)) { 216 SmallString<256> OutName; 217 llvm::raw_svector_ostream Out(OutName); 218 // Don't specify signed/unsigned since integer types can alias despite sign 219 // differences. 220 Out << "_BitInt(" << EIT->getNumBits() << ')'; 221 return createScalarTypeNode(OutName, getChar(), Size); 222 } 223 224 // For now, handle any other kind of type conservatively. 225 return getChar(); 226 } 227 228 llvm::MDNode *CodeGenTBAA::getTypeInfo(QualType QTy) { 229 // At -O0 or relaxed aliasing, TBAA is not emitted for regular types. 230 if (CodeGenOpts.OptimizationLevel == 0 || CodeGenOpts.RelaxedAliasing) 231 return nullptr; 232 233 // If the type has the may_alias attribute (even on a typedef), it is 234 // effectively in the general char alias class. 235 if (TypeHasMayAlias(QTy)) 236 return getChar(); 237 238 // We need this function to not fall back to returning the "omnipotent char" 239 // type node for aggregate and union types. Otherwise, any dereference of an 240 // aggregate will result into the may-alias access descriptor, meaning all 241 // subsequent accesses to direct and indirect members of that aggregate will 242 // be considered may-alias too. 243 // TODO: Combine getTypeInfo() and getBaseTypeInfo() into a single function. 244 if (isValidBaseType(QTy)) 245 return getBaseTypeInfo(QTy); 246 247 const Type *Ty = Context.getCanonicalType(QTy).getTypePtr(); 248 if (llvm::MDNode *N = MetadataCache[Ty]) 249 return N; 250 251 // Note that the following helper call is allowed to add new nodes to the 252 // cache, which invalidates all its previously obtained iterators. So we 253 // first generate the node for the type and then add that node to the cache. 254 llvm::MDNode *TypeNode = getTypeInfoHelper(Ty); 255 return MetadataCache[Ty] = TypeNode; 256 } 257 258 TBAAAccessInfo CodeGenTBAA::getAccessInfo(QualType AccessType) { 259 // Pointee values may have incomplete types, but they shall never be 260 // dereferenced. 261 if (AccessType->isIncompleteType()) 262 return TBAAAccessInfo::getIncompleteInfo(); 263 264 if (TypeHasMayAlias(AccessType)) 265 return TBAAAccessInfo::getMayAliasInfo(); 266 267 uint64_t Size = Context.getTypeSizeInChars(AccessType).getQuantity(); 268 return TBAAAccessInfo(getTypeInfo(AccessType), Size); 269 } 270 271 TBAAAccessInfo CodeGenTBAA::getVTablePtrAccessInfo(llvm::Type *VTablePtrType) { 272 llvm::DataLayout DL(&Module); 273 unsigned Size = DL.getPointerTypeSize(VTablePtrType); 274 return TBAAAccessInfo(createScalarTypeNode("vtable pointer", getRoot(), Size), 275 Size); 276 } 277 278 bool 279 CodeGenTBAA::CollectFields(uint64_t BaseOffset, 280 QualType QTy, 281 SmallVectorImpl<llvm::MDBuilder::TBAAStructField> & 282 Fields, 283 bool MayAlias) { 284 /* Things not handled yet include: C++ base classes, bitfields, */ 285 286 if (const RecordType *TTy = QTy->getAs<RecordType>()) { 287 const RecordDecl *RD = TTy->getDecl()->getDefinition(); 288 if (RD->hasFlexibleArrayMember()) 289 return false; 290 291 // TODO: Handle C++ base classes. 292 if (const CXXRecordDecl *Decl = dyn_cast<CXXRecordDecl>(RD)) 293 if (Decl->bases_begin() != Decl->bases_end()) 294 return false; 295 296 const ASTRecordLayout &Layout = Context.getASTRecordLayout(RD); 297 298 unsigned idx = 0; 299 for (RecordDecl::field_iterator i = RD->field_begin(), 300 e = RD->field_end(); i != e; ++i, ++idx) { 301 if ((*i)->isZeroSize(Context) || (*i)->isUnnamedBitfield()) 302 continue; 303 uint64_t Offset = BaseOffset + 304 Layout.getFieldOffset(idx) / Context.getCharWidth(); 305 QualType FieldQTy = i->getType(); 306 if (!CollectFields(Offset, FieldQTy, Fields, 307 MayAlias || TypeHasMayAlias(FieldQTy))) 308 return false; 309 } 310 return true; 311 } 312 313 /* Otherwise, treat whatever it is as a field. */ 314 uint64_t Offset = BaseOffset; 315 uint64_t Size = Context.getTypeSizeInChars(QTy).getQuantity(); 316 llvm::MDNode *TBAAType = MayAlias ? getChar() : getTypeInfo(QTy); 317 llvm::MDNode *TBAATag = getAccessTagInfo(TBAAAccessInfo(TBAAType, Size)); 318 Fields.push_back(llvm::MDBuilder::TBAAStructField(Offset, Size, TBAATag)); 319 return true; 320 } 321 322 llvm::MDNode * 323 CodeGenTBAA::getTBAAStructInfo(QualType QTy) { 324 const Type *Ty = Context.getCanonicalType(QTy).getTypePtr(); 325 326 if (llvm::MDNode *N = StructMetadataCache[Ty]) 327 return N; 328 329 SmallVector<llvm::MDBuilder::TBAAStructField, 4> Fields; 330 if (CollectFields(0, QTy, Fields, TypeHasMayAlias(QTy))) 331 return MDHelper.createTBAAStructNode(Fields); 332 333 // For now, handle any other kind of type conservatively. 334 return StructMetadataCache[Ty] = nullptr; 335 } 336 337 llvm::MDNode *CodeGenTBAA::getBaseTypeInfoHelper(const Type *Ty) { 338 if (auto *TTy = dyn_cast<RecordType>(Ty)) { 339 const RecordDecl *RD = TTy->getDecl()->getDefinition(); 340 const ASTRecordLayout &Layout = Context.getASTRecordLayout(RD); 341 using TBAAStructField = llvm::MDBuilder::TBAAStructField; 342 SmallVector<TBAAStructField, 4> Fields; 343 if (const CXXRecordDecl *CXXRD = dyn_cast<CXXRecordDecl>(RD)) { 344 // Handle C++ base classes. Non-virtual bases can treated a kind of 345 // field. Virtual bases are more complex and omitted, but avoid an 346 // incomplete view for NewStructPathTBAA. 347 if (CodeGenOpts.NewStructPathTBAA && CXXRD->getNumVBases() != 0) 348 return nullptr; 349 for (const CXXBaseSpecifier &B : CXXRD->bases()) { 350 if (B.isVirtual()) 351 continue; 352 QualType BaseQTy = B.getType(); 353 const CXXRecordDecl *BaseRD = BaseQTy->getAsCXXRecordDecl(); 354 if (BaseRD->isEmpty()) 355 continue; 356 llvm::MDNode *TypeNode = isValidBaseType(BaseQTy) 357 ? getBaseTypeInfo(BaseQTy) 358 : getTypeInfo(BaseQTy); 359 if (!TypeNode) 360 return nullptr; 361 uint64_t Offset = Layout.getBaseClassOffset(BaseRD).getQuantity(); 362 uint64_t Size = 363 Context.getASTRecordLayout(BaseRD).getDataSize().getQuantity(); 364 Fields.push_back( 365 llvm::MDBuilder::TBAAStructField(Offset, Size, TypeNode)); 366 } 367 // The order in which base class subobjects are allocated is unspecified, 368 // so may differ from declaration order. In particular, Itanium ABI will 369 // allocate a primary base first. 370 // Since we exclude empty subobjects, the objects are not overlapping and 371 // their offsets are unique. 372 llvm::sort(Fields, 373 [](const TBAAStructField &A, const TBAAStructField &B) { 374 return A.Offset < B.Offset; 375 }); 376 } 377 for (FieldDecl *Field : RD->fields()) { 378 if (Field->isZeroSize(Context) || Field->isUnnamedBitfield()) 379 continue; 380 QualType FieldQTy = Field->getType(); 381 llvm::MDNode *TypeNode = isValidBaseType(FieldQTy) ? 382 getBaseTypeInfo(FieldQTy) : getTypeInfo(FieldQTy); 383 if (!TypeNode) 384 return nullptr; 385 386 uint64_t BitOffset = Layout.getFieldOffset(Field->getFieldIndex()); 387 uint64_t Offset = Context.toCharUnitsFromBits(BitOffset).getQuantity(); 388 uint64_t Size = Context.getTypeSizeInChars(FieldQTy).getQuantity(); 389 Fields.push_back(llvm::MDBuilder::TBAAStructField(Offset, Size, 390 TypeNode)); 391 } 392 393 SmallString<256> OutName; 394 if (Features.CPlusPlus) { 395 // Don't use the mangler for C code. 396 llvm::raw_svector_ostream Out(OutName); 397 MContext.mangleCanonicalTypeName(QualType(Ty, 0), Out); 398 } else { 399 OutName = RD->getName(); 400 } 401 402 if (CodeGenOpts.NewStructPathTBAA) { 403 llvm::MDNode *Parent = getChar(); 404 uint64_t Size = Context.getTypeSizeInChars(Ty).getQuantity(); 405 llvm::Metadata *Id = MDHelper.createString(OutName); 406 return MDHelper.createTBAATypeNode(Parent, Size, Id, Fields); 407 } 408 409 // Create the struct type node with a vector of pairs (offset, type). 410 SmallVector<std::pair<llvm::MDNode*, uint64_t>, 4> OffsetsAndTypes; 411 for (const auto &Field : Fields) 412 OffsetsAndTypes.push_back(std::make_pair(Field.Type, Field.Offset)); 413 return MDHelper.createTBAAStructTypeNode(OutName, OffsetsAndTypes); 414 } 415 416 return nullptr; 417 } 418 419 llvm::MDNode *CodeGenTBAA::getBaseTypeInfo(QualType QTy) { 420 if (!isValidBaseType(QTy)) 421 return nullptr; 422 423 const Type *Ty = Context.getCanonicalType(QTy).getTypePtr(); 424 425 // nullptr is a valid value in the cache, so use find rather than [] 426 auto I = BaseTypeMetadataCache.find(Ty); 427 if (I != BaseTypeMetadataCache.end()) 428 return I->second; 429 430 // First calculate the metadata, before recomputing the insertion point, as 431 // the helper can recursively call us. 432 llvm::MDNode *TypeNode = getBaseTypeInfoHelper(Ty); 433 LLVM_ATTRIBUTE_UNUSED auto inserted = 434 BaseTypeMetadataCache.insert({Ty, TypeNode}); 435 assert(inserted.second && "BaseType metadata was already inserted"); 436 437 return TypeNode; 438 } 439 440 llvm::MDNode *CodeGenTBAA::getAccessTagInfo(TBAAAccessInfo Info) { 441 assert(!Info.isIncomplete() && "Access to an object of an incomplete type!"); 442 443 if (Info.isMayAlias()) 444 Info = TBAAAccessInfo(getChar(), Info.Size); 445 446 if (!Info.AccessType) 447 return nullptr; 448 449 if (!CodeGenOpts.StructPathTBAA) 450 Info = TBAAAccessInfo(Info.AccessType, Info.Size); 451 452 llvm::MDNode *&N = AccessTagMetadataCache[Info]; 453 if (N) 454 return N; 455 456 if (!Info.BaseType) { 457 Info.BaseType = Info.AccessType; 458 assert(!Info.Offset && "Nonzero offset for an access with no base type!"); 459 } 460 if (CodeGenOpts.NewStructPathTBAA) { 461 return N = MDHelper.createTBAAAccessTag(Info.BaseType, Info.AccessType, 462 Info.Offset, Info.Size); 463 } 464 return N = MDHelper.createTBAAStructTagNode(Info.BaseType, Info.AccessType, 465 Info.Offset); 466 } 467 468 TBAAAccessInfo CodeGenTBAA::mergeTBAAInfoForCast(TBAAAccessInfo SourceInfo, 469 TBAAAccessInfo TargetInfo) { 470 if (SourceInfo.isMayAlias() || TargetInfo.isMayAlias()) 471 return TBAAAccessInfo::getMayAliasInfo(); 472 return TargetInfo; 473 } 474 475 TBAAAccessInfo 476 CodeGenTBAA::mergeTBAAInfoForConditionalOperator(TBAAAccessInfo InfoA, 477 TBAAAccessInfo InfoB) { 478 if (InfoA == InfoB) 479 return InfoA; 480 481 if (!InfoA || !InfoB) 482 return TBAAAccessInfo(); 483 484 if (InfoA.isMayAlias() || InfoB.isMayAlias()) 485 return TBAAAccessInfo::getMayAliasInfo(); 486 487 // TODO: Implement the rest of the logic here. For example, two accesses 488 // with same final access types result in an access to an object of that final 489 // access type regardless of their base types. 490 return TBAAAccessInfo::getMayAliasInfo(); 491 } 492 493 TBAAAccessInfo 494 CodeGenTBAA::mergeTBAAInfoForMemoryTransfer(TBAAAccessInfo DestInfo, 495 TBAAAccessInfo SrcInfo) { 496 if (DestInfo == SrcInfo) 497 return DestInfo; 498 499 if (!DestInfo || !SrcInfo) 500 return TBAAAccessInfo(); 501 502 if (DestInfo.isMayAlias() || SrcInfo.isMayAlias()) 503 return TBAAAccessInfo::getMayAliasInfo(); 504 505 // TODO: Implement the rest of the logic here. For example, two accesses 506 // with same final access types result in an access to an object of that final 507 // access type regardless of their base types. 508 return TBAAAccessInfo::getMayAliasInfo(); 509 } 510