Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 1 | //==- llvm/Analysis/MemoryBuiltins.h - Calls to memory builtins --*- C++ -*-==// |
| 2 | // |
Andrew Walbran | 16937d0 | 2019-10-22 13:54:20 +0100 | [diff] [blame] | 3 | // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. |
| 4 | // See https://llvm.org/LICENSE.txt for license information. |
| 5 | // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception |
Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 6 | // |
| 7 | //===----------------------------------------------------------------------===// |
| 8 | // |
| 9 | // This family of functions identifies calls to builtin functions that allocate |
| 10 | // or free memory. |
| 11 | // |
| 12 | //===----------------------------------------------------------------------===// |
| 13 | |
| 14 | #ifndef LLVM_ANALYSIS_MEMORYBUILTINS_H |
| 15 | #define LLVM_ANALYSIS_MEMORYBUILTINS_H |
| 16 | |
| 17 | #include "llvm/ADT/APInt.h" |
| 18 | #include "llvm/ADT/DenseMap.h" |
| 19 | #include "llvm/ADT/SmallPtrSet.h" |
| 20 | #include "llvm/Analysis/TargetFolder.h" |
Andrew Walbran | 3d2c197 | 2020-04-07 12:24:26 +0100 | [diff] [blame^] | 21 | #include "llvm/Analysis/TargetLibraryInfo.h" |
Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 22 | #include "llvm/IR/CallSite.h" |
| 23 | #include "llvm/IR/IRBuilder.h" |
| 24 | #include "llvm/IR/InstVisitor.h" |
| 25 | #include "llvm/IR/ValueHandle.h" |
| 26 | #include <cstdint> |
| 27 | #include <utility> |
| 28 | |
| 29 | namespace llvm { |
| 30 | |
| 31 | class AllocaInst; |
| 32 | class Argument; |
| 33 | class CallInst; |
| 34 | class ConstantInt; |
| 35 | class ConstantPointerNull; |
| 36 | class DataLayout; |
| 37 | class ExtractElementInst; |
| 38 | class ExtractValueInst; |
| 39 | class GEPOperator; |
| 40 | class GlobalAlias; |
| 41 | class GlobalVariable; |
| 42 | class Instruction; |
| 43 | class IntegerType; |
| 44 | class IntrinsicInst; |
| 45 | class IntToPtrInst; |
| 46 | class LLVMContext; |
| 47 | class LoadInst; |
| 48 | class PHINode; |
| 49 | class PointerType; |
| 50 | class SelectInst; |
| 51 | class TargetLibraryInfo; |
| 52 | class Type; |
| 53 | class UndefValue; |
| 54 | class Value; |
| 55 | |
Andrew Scull | cdfcccc | 2018-10-05 20:58:37 +0100 | [diff] [blame] | 56 | /// Tests if a value is a call or invoke to a library function that |
Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 57 | /// allocates or reallocates memory (either malloc, calloc, realloc, or strdup |
| 58 | /// like). |
| 59 | bool isAllocationFn(const Value *V, const TargetLibraryInfo *TLI, |
| 60 | bool LookThroughBitCast = false); |
| 61 | |
Andrew Scull | cdfcccc | 2018-10-05 20:58:37 +0100 | [diff] [blame] | 62 | /// Tests if a value is a call or invoke to a function that returns a |
Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 63 | /// NoAlias pointer (including malloc/calloc/realloc/strdup-like functions). |
| 64 | bool isNoAliasFn(const Value *V, const TargetLibraryInfo *TLI, |
| 65 | bool LookThroughBitCast = false); |
| 66 | |
Andrew Scull | cdfcccc | 2018-10-05 20:58:37 +0100 | [diff] [blame] | 67 | /// Tests if a value is a call or invoke to a library function that |
Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 68 | /// allocates uninitialized memory (such as malloc). |
| 69 | bool isMallocLikeFn(const Value *V, const TargetLibraryInfo *TLI, |
| 70 | bool LookThroughBitCast = false); |
| 71 | |
Andrew Scull | cdfcccc | 2018-10-05 20:58:37 +0100 | [diff] [blame] | 72 | /// Tests if a value is a call or invoke to a library function that |
Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 73 | /// allocates zero-filled memory (such as calloc). |
| 74 | bool isCallocLikeFn(const Value *V, const TargetLibraryInfo *TLI, |
| 75 | bool LookThroughBitCast = false); |
| 76 | |
Andrew Scull | cdfcccc | 2018-10-05 20:58:37 +0100 | [diff] [blame] | 77 | /// Tests if a value is a call or invoke to a library function that |
Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 78 | /// allocates memory similar to malloc or calloc. |
| 79 | bool isMallocOrCallocLikeFn(const Value *V, const TargetLibraryInfo *TLI, |
| 80 | bool LookThroughBitCast = false); |
| 81 | |
Andrew Scull | cdfcccc | 2018-10-05 20:58:37 +0100 | [diff] [blame] | 82 | /// Tests if a value is a call or invoke to a library function that |
Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 83 | /// allocates memory (either malloc, calloc, or strdup like). |
| 84 | bool isAllocLikeFn(const Value *V, const TargetLibraryInfo *TLI, |
| 85 | bool LookThroughBitCast = false); |
| 86 | |
Andrew Walbran | 3d2c197 | 2020-04-07 12:24:26 +0100 | [diff] [blame^] | 87 | /// Tests if a value is a call or invoke to a library function that |
| 88 | /// reallocates memory (e.g., realloc). |
| 89 | bool isReallocLikeFn(const Value *V, const TargetLibraryInfo *TLI, |
| 90 | bool LookThroughBitCast = false); |
| 91 | |
| 92 | /// Tests if a function is a call or invoke to a library function that |
| 93 | /// reallocates memory (e.g., realloc). |
| 94 | bool isReallocLikeFn(const Function *F, const TargetLibraryInfo *TLI); |
| 95 | |
Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 96 | //===----------------------------------------------------------------------===// |
| 97 | // malloc Call Utility Functions. |
| 98 | // |
| 99 | |
| 100 | /// extractMallocCall - Returns the corresponding CallInst if the instruction |
| 101 | /// is a malloc call. Since CallInst::CreateMalloc() only creates calls, we |
| 102 | /// ignore InvokeInst here. |
| 103 | const CallInst *extractMallocCall(const Value *I, const TargetLibraryInfo *TLI); |
| 104 | inline CallInst *extractMallocCall(Value *I, const TargetLibraryInfo *TLI) { |
| 105 | return const_cast<CallInst*>(extractMallocCall((const Value*)I, TLI)); |
| 106 | } |
| 107 | |
| 108 | /// getMallocType - Returns the PointerType resulting from the malloc call. |
| 109 | /// The PointerType depends on the number of bitcast uses of the malloc call: |
| 110 | /// 0: PointerType is the malloc calls' return type. |
| 111 | /// 1: PointerType is the bitcast's result type. |
| 112 | /// >1: Unique PointerType cannot be determined, return NULL. |
| 113 | PointerType *getMallocType(const CallInst *CI, const TargetLibraryInfo *TLI); |
| 114 | |
| 115 | /// getMallocAllocatedType - Returns the Type allocated by malloc call. |
| 116 | /// The Type depends on the number of bitcast uses of the malloc call: |
| 117 | /// 0: PointerType is the malloc calls' return type. |
| 118 | /// 1: PointerType is the bitcast's result type. |
| 119 | /// >1: Unique PointerType cannot be determined, return NULL. |
| 120 | Type *getMallocAllocatedType(const CallInst *CI, const TargetLibraryInfo *TLI); |
| 121 | |
| 122 | /// getMallocArraySize - Returns the array size of a malloc call. If the |
| 123 | /// argument passed to malloc is a multiple of the size of the malloced type, |
| 124 | /// then return that multiple. For non-array mallocs, the multiple is |
| 125 | /// constant 1. Otherwise, return NULL for mallocs whose array size cannot be |
| 126 | /// determined. |
| 127 | Value *getMallocArraySize(CallInst *CI, const DataLayout &DL, |
| 128 | const TargetLibraryInfo *TLI, |
| 129 | bool LookThroughSExt = false); |
| 130 | |
| 131 | //===----------------------------------------------------------------------===// |
| 132 | // calloc Call Utility Functions. |
| 133 | // |
| 134 | |
| 135 | /// extractCallocCall - Returns the corresponding CallInst if the instruction |
| 136 | /// is a calloc call. |
| 137 | const CallInst *extractCallocCall(const Value *I, const TargetLibraryInfo *TLI); |
| 138 | inline CallInst *extractCallocCall(Value *I, const TargetLibraryInfo *TLI) { |
| 139 | return const_cast<CallInst*>(extractCallocCall((const Value*)I, TLI)); |
| 140 | } |
| 141 | |
| 142 | |
| 143 | //===----------------------------------------------------------------------===// |
| 144 | // free Call Utility Functions. |
| 145 | // |
| 146 | |
Andrew Walbran | 3d2c197 | 2020-04-07 12:24:26 +0100 | [diff] [blame^] | 147 | /// isLibFreeFunction - Returns true if the function is a builtin free() |
| 148 | bool isLibFreeFunction(const Function *F, const LibFunc TLIFn); |
| 149 | |
Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 150 | /// isFreeCall - Returns non-null if the value is a call to the builtin free() |
| 151 | const CallInst *isFreeCall(const Value *I, const TargetLibraryInfo *TLI); |
| 152 | |
| 153 | inline CallInst *isFreeCall(Value *I, const TargetLibraryInfo *TLI) { |
| 154 | return const_cast<CallInst*>(isFreeCall((const Value*)I, TLI)); |
| 155 | } |
| 156 | |
| 157 | //===----------------------------------------------------------------------===// |
| 158 | // Utility functions to compute size of objects. |
| 159 | // |
| 160 | |
| 161 | /// Various options to control the behavior of getObjectSize. |
| 162 | struct ObjectSizeOpts { |
| 163 | /// Controls how we handle conditional statements with unknown conditions. |
| 164 | enum class Mode : uint8_t { |
| 165 | /// Fail to evaluate an unknown condition. |
| 166 | Exact, |
| 167 | /// Evaluate all branches of an unknown condition. If all evaluations |
| 168 | /// succeed, pick the minimum size. |
| 169 | Min, |
| 170 | /// Same as Min, except we pick the maximum size of all of the branches. |
| 171 | Max |
| 172 | }; |
| 173 | |
| 174 | /// How we want to evaluate this object's size. |
| 175 | Mode EvalMode = Mode::Exact; |
| 176 | /// Whether to round the result up to the alignment of allocas, byval |
| 177 | /// arguments, and global variables. |
| 178 | bool RoundToAlign = false; |
| 179 | /// If this is true, null pointers in address space 0 will be treated as |
| 180 | /// though they can't be evaluated. Otherwise, null is always considered to |
| 181 | /// point to a 0 byte region of memory. |
| 182 | bool NullIsUnknownSize = false; |
| 183 | }; |
| 184 | |
Andrew Scull | cdfcccc | 2018-10-05 20:58:37 +0100 | [diff] [blame] | 185 | /// Compute the size of the object pointed by Ptr. Returns true and the |
Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 186 | /// object size in Size if successful, and false otherwise. In this context, by |
| 187 | /// object we mean the region of memory starting at Ptr to the end of the |
| 188 | /// underlying object pointed to by Ptr. |
| 189 | bool getObjectSize(const Value *Ptr, uint64_t &Size, const DataLayout &DL, |
| 190 | const TargetLibraryInfo *TLI, ObjectSizeOpts Opts = {}); |
| 191 | |
Andrew Scull | cdfcccc | 2018-10-05 20:58:37 +0100 | [diff] [blame] | 192 | /// Try to turn a call to \@llvm.objectsize into an integer value of the given |
Andrew Walbran | 16937d0 | 2019-10-22 13:54:20 +0100 | [diff] [blame] | 193 | /// Type. Returns null on failure. If MustSucceed is true, this function will |
| 194 | /// not return null, and may return conservative values governed by the second |
| 195 | /// argument of the call to objectsize. |
| 196 | Value *lowerObjectSizeCall(IntrinsicInst *ObjectSize, const DataLayout &DL, |
| 197 | const TargetLibraryInfo *TLI, bool MustSucceed); |
| 198 | |
| 199 | |
Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 200 | |
| 201 | using SizeOffsetType = std::pair<APInt, APInt>; |
| 202 | |
Andrew Scull | cdfcccc | 2018-10-05 20:58:37 +0100 | [diff] [blame] | 203 | /// Evaluate the size and offset of an object pointed to by a Value* |
Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 204 | /// statically. Fails if size or offset are not known at compile time. |
| 205 | class ObjectSizeOffsetVisitor |
| 206 | : public InstVisitor<ObjectSizeOffsetVisitor, SizeOffsetType> { |
| 207 | const DataLayout &DL; |
| 208 | const TargetLibraryInfo *TLI; |
| 209 | ObjectSizeOpts Options; |
| 210 | unsigned IntTyBits; |
| 211 | APInt Zero; |
| 212 | SmallPtrSet<Instruction *, 8> SeenInsts; |
| 213 | |
| 214 | APInt align(APInt Size, uint64_t Align); |
| 215 | |
| 216 | SizeOffsetType unknown() { |
| 217 | return std::make_pair(APInt(), APInt()); |
| 218 | } |
| 219 | |
| 220 | public: |
| 221 | ObjectSizeOffsetVisitor(const DataLayout &DL, const TargetLibraryInfo *TLI, |
| 222 | LLVMContext &Context, ObjectSizeOpts Options = {}); |
| 223 | |
| 224 | SizeOffsetType compute(Value *V); |
| 225 | |
| 226 | static bool knownSize(const SizeOffsetType &SizeOffset) { |
| 227 | return SizeOffset.first.getBitWidth() > 1; |
| 228 | } |
| 229 | |
| 230 | static bool knownOffset(const SizeOffsetType &SizeOffset) { |
| 231 | return SizeOffset.second.getBitWidth() > 1; |
| 232 | } |
| 233 | |
| 234 | static bool bothKnown(const SizeOffsetType &SizeOffset) { |
| 235 | return knownSize(SizeOffset) && knownOffset(SizeOffset); |
| 236 | } |
| 237 | |
| 238 | // These are "private", except they can't actually be made private. Only |
| 239 | // compute() should be used by external users. |
| 240 | SizeOffsetType visitAllocaInst(AllocaInst &I); |
| 241 | SizeOffsetType visitArgument(Argument &A); |
| 242 | SizeOffsetType visitCallSite(CallSite CS); |
| 243 | SizeOffsetType visitConstantPointerNull(ConstantPointerNull&); |
| 244 | SizeOffsetType visitExtractElementInst(ExtractElementInst &I); |
| 245 | SizeOffsetType visitExtractValueInst(ExtractValueInst &I); |
| 246 | SizeOffsetType visitGEPOperator(GEPOperator &GEP); |
| 247 | SizeOffsetType visitGlobalAlias(GlobalAlias &GA); |
| 248 | SizeOffsetType visitGlobalVariable(GlobalVariable &GV); |
| 249 | SizeOffsetType visitIntToPtrInst(IntToPtrInst&); |
| 250 | SizeOffsetType visitLoadInst(LoadInst &I); |
| 251 | SizeOffsetType visitPHINode(PHINode&); |
| 252 | SizeOffsetType visitSelectInst(SelectInst &I); |
| 253 | SizeOffsetType visitUndefValue(UndefValue&); |
| 254 | SizeOffsetType visitInstruction(Instruction &I); |
| 255 | |
| 256 | private: |
| 257 | bool CheckedZextOrTrunc(APInt &I); |
| 258 | }; |
| 259 | |
| 260 | using SizeOffsetEvalType = std::pair<Value *, Value *>; |
| 261 | |
Andrew Scull | cdfcccc | 2018-10-05 20:58:37 +0100 | [diff] [blame] | 262 | /// Evaluate the size and offset of an object pointed to by a Value*. |
Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 263 | /// May create code to compute the result at run-time. |
| 264 | class ObjectSizeOffsetEvaluator |
| 265 | : public InstVisitor<ObjectSizeOffsetEvaluator, SizeOffsetEvalType> { |
Andrew Walbran | 3d2c197 | 2020-04-07 12:24:26 +0100 | [diff] [blame^] | 266 | using BuilderTy = IRBuilder<TargetFolder, IRBuilderCallbackInserter>; |
Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 267 | using WeakEvalType = std::pair<WeakTrackingVH, WeakTrackingVH>; |
| 268 | using CacheMapTy = DenseMap<const Value *, WeakEvalType>; |
| 269 | using PtrSetTy = SmallPtrSet<const Value *, 8>; |
| 270 | |
| 271 | const DataLayout &DL; |
| 272 | const TargetLibraryInfo *TLI; |
| 273 | LLVMContext &Context; |
| 274 | BuilderTy Builder; |
| 275 | IntegerType *IntTy; |
| 276 | Value *Zero; |
| 277 | CacheMapTy CacheMap; |
| 278 | PtrSetTy SeenVals; |
Andrew Walbran | 16937d0 | 2019-10-22 13:54:20 +0100 | [diff] [blame] | 279 | ObjectSizeOpts EvalOpts; |
Andrew Walbran | 3d2c197 | 2020-04-07 12:24:26 +0100 | [diff] [blame^] | 280 | SmallPtrSet<Instruction *, 8> InsertedInstructions; |
Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 281 | |
| 282 | SizeOffsetEvalType compute_(Value *V); |
| 283 | |
| 284 | public: |
Andrew Walbran | 16937d0 | 2019-10-22 13:54:20 +0100 | [diff] [blame] | 285 | static SizeOffsetEvalType unknown() { |
| 286 | return std::make_pair(nullptr, nullptr); |
| 287 | } |
| 288 | |
Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 289 | ObjectSizeOffsetEvaluator(const DataLayout &DL, const TargetLibraryInfo *TLI, |
Andrew Walbran | 16937d0 | 2019-10-22 13:54:20 +0100 | [diff] [blame] | 290 | LLVMContext &Context, ObjectSizeOpts EvalOpts = {}); |
Andrew Scull | 5e1ddfa | 2018-08-14 10:06:54 +0100 | [diff] [blame] | 291 | |
| 292 | SizeOffsetEvalType compute(Value *V); |
| 293 | |
| 294 | bool knownSize(SizeOffsetEvalType SizeOffset) { |
| 295 | return SizeOffset.first; |
| 296 | } |
| 297 | |
| 298 | bool knownOffset(SizeOffsetEvalType SizeOffset) { |
| 299 | return SizeOffset.second; |
| 300 | } |
| 301 | |
| 302 | bool anyKnown(SizeOffsetEvalType SizeOffset) { |
| 303 | return knownSize(SizeOffset) || knownOffset(SizeOffset); |
| 304 | } |
| 305 | |
| 306 | bool bothKnown(SizeOffsetEvalType SizeOffset) { |
| 307 | return knownSize(SizeOffset) && knownOffset(SizeOffset); |
| 308 | } |
| 309 | |
| 310 | // The individual instruction visitors should be treated as private. |
| 311 | SizeOffsetEvalType visitAllocaInst(AllocaInst &I); |
| 312 | SizeOffsetEvalType visitCallSite(CallSite CS); |
| 313 | SizeOffsetEvalType visitExtractElementInst(ExtractElementInst &I); |
| 314 | SizeOffsetEvalType visitExtractValueInst(ExtractValueInst &I); |
| 315 | SizeOffsetEvalType visitGEPOperator(GEPOperator &GEP); |
| 316 | SizeOffsetEvalType visitIntToPtrInst(IntToPtrInst&); |
| 317 | SizeOffsetEvalType visitLoadInst(LoadInst &I); |
| 318 | SizeOffsetEvalType visitPHINode(PHINode &PHI); |
| 319 | SizeOffsetEvalType visitSelectInst(SelectInst &I); |
| 320 | SizeOffsetEvalType visitInstruction(Instruction &I); |
| 321 | }; |
| 322 | |
| 323 | } // end namespace llvm |
| 324 | |
| 325 | #endif // LLVM_ANALYSIS_MEMORYBUILTINS_H |